CVE-2026-91831— Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
Quick assessment
Affected
Unknown Subscribe to Comments
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的"Subscribe to Comments"插件在 2.3.3 版本之前，未对通知发件人名称设置中的换行符进行过滤，随后便将其用于电子邮件标题中。这允许拥有作者（Author）及以上权限的用户注入任意电子邮件头（例如隐藏的 Bcc），并伪造发件人身份。
Possible ATT&CK Techniques 2 AI
T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1070.004 · File DeletionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Subscribe to Comments | 2.3< 2.3.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91831
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
Source: CVE Program / CVE List V5
Vulnerability Description
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Subscribe to Comments | 2.3 ~ 2.3.3 | - |
|
II. Public POCs for CVE-2026-91831
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91831
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-19 · 20 CVEs total
| CVE-2026-74921 | 6.8 MEDIUM | Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes |
| CVE-2026-94231 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creati |
| CVE-2026-94272 | 5.3 MEDIUM | Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple A |
| CVE-2026-94230 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbit |
| CVE-2026-94229 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via |
| CVE-2026-94228 | 5.3 MEDIUM | TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite v |
| CVE-2026-86791 | 5.3 MEDIUM | iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Fo |
| CVE-2026-74922 | 5.3 MEDIUM | Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber |
| CVE-2026-94294 | 5.3 MEDIUM | App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.ph |
| CVE-2026-103311 | 5.3 MEDIUM | Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signa |
| CVE-2026-106010 | 5.3 MEDIUM | BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery |
| CVE-2026-110034 | 3.7 LOW | Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code |
| CVE-2026-94273 | Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_com | |
| CVE-2026-89286 | FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File | |
| CVE-2026-106014 | Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment C | |
| CVE-2026-91047 | ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass | |
| CVE-2026-106933 | Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-91046 | ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Mi | |
| CVE-2026-106028 | ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation |
IV. Related Vulnerabilities
Same product: Subscribe to Comments
-
CVE-2026-91830
Subscribe to Comments < 2.3.3 - Unauthenticated Subscription -
CVE-2026-91829
Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Para -
CVE-2026-66706
WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site -
CVE-2015-10133
Subscribe to Comments <= 2.1.2 - Local File Includion -
CVE-2024-8792
Subscribe to Comments <= 2.3 - Reflected Cross-Site Scriptin
Same vendor: Unknown
-
CVE-2026-96903
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data -
CVE-2026-96902
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Lis -
CVE-2026-94294
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and -
CVE-2026-94231
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94272
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Orde
V. Comments for CVE-2026-91831
No comments yet