EUVD-2026-40907
GHSA-95c2-pg6v-7hqp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H reflects the required non-default admin configuration as a gating precondition; C:L added because notification email content including PII is disclosed to the attacker via Bcc injection.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to get_reply_to_address() processing the Reply-To display name through smart-tag expansion with context 'notification' instead of 'notification-reply-to', which bypasses email-address validation while wpforms_sanitize_textarea_field() intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw Reply-To: mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers - such as Bcc: - into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.
AnalysisAI
CRLF injection in WPForms plugin for WordPress (all versions up to and including 1.10.2) enables unauthenticated attackers to silently blind-copy all site notification emails to an attacker-controlled address. The flaw originates from get_reply_to_address() applying the wrong smart-tag expansion context, allowing CR/LF characters preserved by wpforms_sanitize_textarea_field() to pass unstripped into raw mail header concatenation. Exploitation requires a specific non-default site configuration but demands no authentication or elevated interaction beyond a standard form submission; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
WPForms (CPE: cpe:2.3:a:smub:wpforms_-_ai_form_builder_for_wordpress_-_contact_forms,_payment_forms,_survey_form,_quiz_&_more:*:*:*:*:*:*:*:*) is a widely deployed WordPress form-builder plugin. The vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences) and exists in the email notification pipeline across src/Emails/Notifications.php (lines 1098 and 1138) and src/Emails/Mailer.php (line 368). When a Paragraph Text (textarea) field is designated as the Reply-To display name source via a Smart Tag, get_reply_to_address() expands that Smart Tag under the broader context 'notification' rather than the stricter 'notification-reply-to' context, circumventing email-address validation. The function wpforms_sanitize_textarea_field() intentionally preserves carriage-return and line-feed characters for multi-line text fields (see includes/fields/class-textarea.php#L326), and these characters are never stripped before concatenation into the raw Reply-To: header string in the mailer. An attacker who submits a form with a crafted textarea value containing CRLF sequences can therefore inject arbitrary SMTP headers - such as Bcc: - into every outgoing notification email generated by that form.
RemediationAI
Update WPForms (wpforms-lite) to version 1.10.2.1 or later, which addresses the CRLF injection by correcting the smart-tag expansion context in get_reply_to_address() and ensuring CR/LF characters are stripped before header concatenation, as confirmed by the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpforms-lite/tags/1.10.2&new_path=%2Fwpforms-lite/tags/1.10.2.1. If an immediate update is not possible, the most targeted compensating control is to audit all active form notifications and remove any Paragraph Text (textarea) field Smart Tags from the Reply-To display name field - replacing them with a static email address or a non-textarea field Smart Tag - which eliminates the injection vector for that form without disabling notifications. A more aggressive workaround is disabling the Reply-To header across all notifications entirely; this removes the attack surface but prevents recipients from replying directly to submitters. WAF rules attempting to block CRLF sequences in POST bodies are unreliable due to encoding variations and double-encoding bypasses and should not be treated as a primary mitigation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today