CVE-2026-4257·PHP vulnerability

How to fix this CVE

Update the Contact Form by Supsystic plugin to version 1.7.37 or later, or deactivate and remove it. Replace with a well-maintained alternative (Contact Form 7, WPForms, Gravity Forms). Audit for signs of compromise.

# Update the plugin:
wp plugin update contact-form-by-supsystic --path=/var/www/html
# Or remove it:
wp plugin deactivate contact-form-by-supsystic --path=/var/www/html
wp plugin delete contact-form-by-supsystic --path=/var/www/html
# Scan for compromise:
find /var/www -name '*.php' -newer /var/log/syslog -mtime -7 -exec grep -l 'eval\|system\|exec' {} \;

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /wp-admin/admin-ajax.php HTTP/1.1
action=ssc_contact_form_submit&form_data={{constructor.constructor('return process')().mainModule.require('child_process').execSync('id')}}

The attacker submits a form with template injection payloads in form fields. The plugin's template engine evaluates the injected code, executing arbitrary system commands.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

SecRule ARGS "@rx \{\{.*(?:constructor|process|require|exec|system|spawn).*\}\}" "id:20264257,phase:2,deny,status:403,msg:'CVE-2026-4257 SSTI attempt via Supsystic Contact Form',severity:CRITICAL"

SecRule ARGS:action "@streq ssc_contact_form_submit" "id:20264258,phase:2,chain"
SecRule ARGS "@rx \{\{" "deny,status:403,msg:'Template injection in contact form'"

How to check if you are affected

1. Check if the plugin is installed: wp plugin list --path=/var/www/html | grep contact-form-by-supsystic
2. Check version: wp plugin get contact-form-by-supsystic --path=/var/www/html --field=version — vulnerable if <= 1.7.36
3. Search access logs for SSTI attempts: grep 'ssc_contact_form_submit' /var/log/apache2/access.log
4. Search POST bodies for template syntax: grep -r '{{' /var/log/apache2/ | grep supsystic
5. Scan for dropped web shells: find /var/www -name '*.php' -mtime -7 -exec grep -l 'eval\|base64_decode' {} \;

Indicators of compromise

• POST requests to admin-ajax.php with action=ssc_contact_form_submit containing {{ or {% sequences
• Template engine error messages in WordPress debug logs
• New PHP files created by the web server user in wp-content/
• Unexpected outbound connections from the web server process
• Modified .htaccess or wp-config.php files

FAQ

Related PHP CVEs

References

• https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php#L323
• https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic
• https://www.wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61?source=cve