Read the docs
TI-2026-76257 Aliases CVE-2026-91831GHSA-fwc8-9qp3-8f5c

CRLF injection in Subscribe to Comments WordPress plugin e-mail headers

Priority LOW 17CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Subscribe to Comments WordPress plugin from 2.3 before 2.3.3 does not remove newline characters from the notification sender-name setting before using it in e-mail headers. An authenticated user with Author-level access or higher can inject arbitrary e-mail headers, such as a hidden Bcc, and spoof the sender. The CVSS vector requires high privileges and low attack complexity over the network. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Subscribe to Comments (Unknown): 2.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSubscribe to Comments2.3 to before 2.3.32.3.3Patch availableCNA
  • Subscribe to Comments VendorUnknown Affected 2.3 to before 2.3.3 Fixed in 2.3.3 Patch available CNA

Remediation

Update Subscribe to Comments to version 2.3.3.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Subscribe to Comments (Unknown) Fixed in 2.3.3

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-91831
  2. 2026-10-19 Weakness changed · CISA ADP
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Alias added: GHSA-fwc8-9qp3-8f5c

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences