bootstrapbool/cve-2026-4257
This exploits CVE-2026-4257, a Server-Side Template Injection (SSTI) vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution.
The vulnerability exists in the generateHtml() function of the formsViewCfs class, which accepts user-controlled input via any one of the Contact Form field parameters given it is of an appropriate type.
*Tested on Ubuntu 24.04 and Contact Form by Supsystic version 1.7.36
*See msf-exploit.md for module documentation.
The field used to inject the payload. Must be a valid field used by the Contact Form of an appropriate type.
The field types that accept user input and have been confirmed to lead to RCE are Text, Textarea, Number, Email, Time, and URL. Button field types do not work.
The default fields are first_name, last_name, subject, message, and email, though anyone of these can be changed or removed.
If the FIELD isn't passed the module will attempt to derive them from the html, however no type detection is performed so the detected field could be of an invalid type. Only the first derived field is used but you can manually try the others that are output.
Prevents use of ANSI escape codes (useful for piping output).
The shell command to be executed.
The url to the application including the full filepath to the page containing the vulnerable contact form (e.g. http://10.0.0.9/wordpress/index.php/sample-page)
