Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

MetForm plugin can let attackers add hidden email recipients

CVE-2026-86813 · published 1 month ago
Summary

The MetForm WordPress plugin lets users enter text that becomes part of the email header when a form is submitted. Because it does not strip line‑break characters, an attacker could insert extra header lines such as Bcc to send copies of messages to other addresses. Update the plugin to version 4.1.9 or later, or apply a patch that sanitises header input, to stop this behavior.

What to do
  • Update unknown metform to version 4.1.9 or later.
Affected software
VendorProductAffected versions
unknown metform < 4.1.9
Original advisory text
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attacker...
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published11 Sep 2026
Updated4 Nov 2026
First seen11 Sep 2026
Sources
CVE-2026-86813 · NVD
CVE-2026-86813 · MITRE
Track software like this
Free during beta