CVE-2026-86813: MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/metformto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
What configuration is required for exploitation?
A submitted form field must be configured to populate a notification email header, such as Reply-To. The vulnerable handling occurs when an attacker-controlled value is placed into that header.
Does an attacker need an account or user interaction?
No. The issue is exploitable without authentication or user interaction, although the attacker must be able to submit a relevant form.
What could an attacker do with this issue?
An attacker can include newline characters in a submitted value to inject additional email headers, such as Bcc, into notification emails sent by the site.
How can I determine whether my site is affected?
Sites using MetForm versions before 4.1.9 are affected if their notification configuration maps a user-submitted field into an email header. Review form notification settings, particularly Reply-To and other header-populating fields.