Is CVE-2026-12127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12127 being exploited in the wild.

How severe is CVE-2026-12127?

Medium severity, with a CVSS score of 5.3, published 1 July 2026.

Which products and versions are affected?

WPForms up to and including 1.10.2.

Is there a fix for CVE-2026-12127?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12127 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12127?

Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12127: WPForms CRLF injection in email notifications

CVE-2026-12127 · Severity: medium · CVSS 5.3 · Published 2026-07-01

WPForms, a popular WordPress plugin used for creating contact and payment forms, is vulnerable to a flaw that allows attackers to manipulate email headers. By submitting specially crafted data through a form, an unauthenticated user can inject additional email instructions, such as BCC addresses, into notification emails. This could allow an attacker to silently receive copies of sensitive form submissions, potentially exposing customer data or internal communications.

Technologies: WPForms. Vendors: WPForms.

Quick answers

Is CVE-2026-12127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12127 being exploited in the wild.
How severe is CVE-2026-12127?: Medium severity, with a CVSS score of 5.3, published 1 July 2026.
Which products and versions are affected?: WPForms up to and including 1.10.2.
Is there a fix for CVE-2026-12127?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12127 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12127?: Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WPForms plugin for WordPress is vulnerable to CRLF Injection (CWE-93) in versions up to 1.10.2. The vulnerability exists in the `get_reply_to_address()` function, which processes the 'Reply-To' display name using smart-tag expansion with an incorrect context. This bypasses standard email validation while the `wpforms_sanitize_textarea_field()` function preserves carriage return and line feed characters. An unauthenticated attacker can exploit this by submitting a form where a Paragraph Text field is used as the Reply-To display name, allowing them to inject headers like 'Bcc:' into the raw mail string. This enables the silent redirection or blind-copying of notification emails to external addresses. The issue is fixed in version 1.10.2.1.

Affected products

WPForms WPForms up to and including 1.10.2

Timeline

2026-07-01: disclosed
2026-07-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.