Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12127— WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

Quick assessment

Affected
smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Syed Balkhi WPForms是Syed Balkhi个人开发者的一款WordPress表单构建插件。 Syed Balkhi WPForms 1.10.2及之前版本存在输入验证错误漏洞，该漏洞源于对CRLF序列的中和不当，这是由于 处理Reply-To显示名称时使用错误的上下文导致绕过电子邮件地址验证，同时 保留CR/LF字符，使得未经身份验证的攻击者可以向出站通知电子邮件中注入额外

CVSS 5.3 · Medium EPSS 0.60% · P47

Possible ATT&CK Techniques 1 AI

T1534 · Internal Spearphishing

Affected Version Matrix 1

VendorProduct Version RangeStatus
smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More ≤ 1.10.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12127

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
Source: CVE Program / CVE List V5
Vulnerability Description
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers — such as `Bcc:` — into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Syed Balkhi WPForms 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Syed Balkhi WPForms是Syed Balkhi个人开发者的一款WordPress表单构建插件。 Syed Balkhi WPForms 1.10.2及之前版本存在输入验证错误漏洞，该漏洞源于对CRLF序列的中和不当，这是由于`get_reply_to_address()`处理Reply-To显示名称时使用错误的上下文导致绕过电子邮件地址验证，同时`wpforms_sanitize_textarea_field()`保留CR/LF字符，使得未经身份验证的攻击者可以向出站通知电子邮件中注入额外
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 0 ~ 1.10.2 -

II. Public POCs for CVE-2026-12127

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12127

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12127 (3)

Vendor Advisories for CVE-2026-12127 (1)

Other References for CVE-2026-12127 (1)

IV. Related Vulnerabilities

Same product: WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Same vendor: smub
Same weakness: CWE-93

V. Comments for CVE-2026-12127

No comments yet

Leave a comment