smub WPForms Plugin up to 1.10.2 on WordPress Notification Email get_reply_to_address crlf injection

Summaryinfo

A vulnerability was found in smub WPForms Plugin up to 1.10.2 on WordPress. It has been rated as critical. Affected is the function get_reply_to_address of the component Notification Email Handler. The manipulation leads to crlf injection. This vulnerability is documented as CVE-2026-12127. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in smub WPForms Plugin up to 1.10.2 on WordPress. It has been rated as critical. This issue affects the function get_reply_to_address of the component Notification Email Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers — such as `Bcc:` — into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.

The weakness was released by Jack Pas. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-12127 since 06/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40907). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• smub

Name

• WPForms Plugin

Version

• 1.10.0
• 1.10.1
• 1.10.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion