Executive brief
WPForms, a popular WordPress plugin used for creating contact and payment forms, is vulnerable to a flaw that allows attackers to manipulate email headers. By submitting specially crafted data through a form, an unauthenticated user can inject additional email instructions, such as BCC addresses, into notification emails. This could allow an attacker to silently receive copies of sensitive form submissions, potentially exposing customer data or internal communications.
Technical details
The WPForms plugin for WordPress is vulnerable to CRLF Injection (CWE-93) in versions up to 1.10.2. The vulnerability exists in the `get_reply_to_address()` function, which processes the 'Reply-To' display name using smart-tag expansion with an incorrect context. This bypasses standard email validation while the `wpforms_sanitize_textarea_field()` function preserves carriage return and line feed characters. An unauthenticated attacker can exploit this by submitting a form where a Paragraph Text field is used as the Reply-To display name, allowing them to inject headers like 'Bcc:' into the raw mail string. This enables the silent redirection or blind-copying of notification emails to external addresses. The issue is fixed in version 1.10.2.1.
Affected products
- WPForms WPForms up to and including 1.10.2
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
References
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php
- https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php