# CVE-2026-12127: WPForms CRLF injection in email notifications

Source: https://junglewise.ai/threats/cve-2026-12127-wpforms-crlf-injection-in-email-notifications  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-12127 · Severity: medium · CVSS 5.3 · Published 2026-07-01

WPForms, a popular WordPress plugin used for creating contact and payment forms, is vulnerable to a flaw that allows attackers to manipulate email headers. By submitting specially crafted data through a form, an unauthenticated user can inject additional email instructions, such as BCC addresses, into notification emails. This could allow an attacker to silently receive copies of sensitive form submissions, potentially exposing customer data or internal communications.

Technologies: [WPForms](https://junglewise.ai/threats/technologies/wpforms). Vendors: [WPForms](https://junglewise.ai/threats/vendors/wpforms).

## Quick answers

**Is CVE-2026-12127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12127 being exploited in the wild.

**How severe is CVE-2026-12127?** Medium severity, with a CVSS score of 5.3, published 1 July 2026.

**Which products and versions are affected?** WPForms up to and including 1.10.2.

**Is there a fix for CVE-2026-12127?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12127 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12127?** Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WPForms plugin for WordPress is vulnerable to CRLF Injection (CWE-93) in versions up to 1.10.2. The vulnerability exists in the `get_reply_to_address()` function, which processes the 'Reply-To' display name using smart-tag expansion with an incorrect context. This bypasses standard email validation while the `wpforms_sanitize_textarea_field()` function preserves carriage return and line feed characters. An unauthenticated attacker can exploit this by submitting a form where a Paragraph Text field is used as the Reply-To display name, allowing them to inject headers like 'Bcc:' into the raw mail string. This enables the silent redirection or blind-copying of notification emails to external addresses. The issue is fixed in version 1.10.2.1.

## Affected products

- WPForms WPForms up to and including 1.10.2

## Timeline

- 2026-07-01: disclosed
- 2026-07-01: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php)

## Related threats

- [WPForms plugin reflected cross-site scripting in smart tags](https://junglewise.ai/threats/cve-2026-101921-the-wpforms-ai-form-builder-for-wordpress-contact-forms-payment)
- [WPForms access control bypass in Stripe payment handling](https://junglewise.ai/threats/cve-2026-74991-the-wpforms-wordpress-plugin-before-2-0-2-does-not-verify-that-a)
- [WPForms Stored XSS in OptinMonster Integration](https://junglewise.ai/threats/cve-2026-15782-wpforms-stored-xss-in-optinmonster-integration)
- [WPForms PayPal Commerce webhook data authenticity bypass](https://junglewise.ai/threats/cve-2026-7792-wpforms-paypal-commerce-webhook-data-authenticity-bypass)