What is the CVSS score of CVE-2026-2442?

CVE-2026-2442 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2442?

Organizations using all should be aware of moderate risk from CVE-2026-2442 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-2442?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-2442

EUVD-2026-16911 MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-03-28 Wordfence

GHSA-224p-vx89-7gp5

GHSA-6rpr-9cmg-mvvj

WordPress Code Injection

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 28, 2026 - 09:45 euvd

EUVD-2026-16911

Analysis Generated

Mar 28, 2026 - 09:45 vuln.today

CVE Published

Mar 28, 2026 - 09:27 nvd

MEDIUM 5.3

DescriptionCVE.org

The Page Builder: Pagelayer - Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 2.0.7. This is due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.

AnalysisAI

CRLF injection in Page Builder: Pagelayer WordPress plugin up to version 2.0.7 allows unauthenticated attackers to inject arbitrary email headers (Bcc, Cc, etc.) through contact form fields. The vulnerability exploits unsafe placeholder substitution in email headers without CR/LF sanitization, enabling email header spoofing and potential abuse of form email delivery systems. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the contact form handler component of Pagelayer, a WordPress page builder plugin that processes user-submitted form data. When contact forms are configured with placeholders in mail template headers, the plugin performs placeholder substitution on attacker-controlled form field values (such as the 'email' parameter) without stripping carriage return (CR, \r) and line feed (LF, \n) characters. These characters are then passed directly into email header construction, violating CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers). This allows attackers to inject additional SMTP commands and headers by embedding CR/LF sequences in form submissions, exploiting the trust chain between the form handler and the underlying email delivery mechanism.

RemediationAI

Update the Page Builder: Pagelayer plugin to version 2.0.8 or later, which addresses the CRLF injection vulnerability by implementing proper input sanitization. Site administrators should immediately apply this patch via the WordPress plugin dashboard (Plugins > Installed Plugins > Page Builder: Pagelayer > Update). Until patching is completed, administrators should audit contact form configurations to disable placeholders in email header fields where possible, reducing the attack surface. For technical details and verification, refer to the official WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset/3464204/pagelayer and the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce101aad-10a3-4a8c-9f4a-0e38e35b4dab.