CVE-2026-91831: Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it. The attacker needs access to the plugin's notification sender-name setting.
What versions are affected and what version fixes it?
Subscribe to Comments versions 2.3 through 2.3.2 are affected. Version 2.3.3 addresses the issue.
What can an attacker do with successful exploitation?
An attacker can inject arbitrary e-mail headers into notification messages. This can be used to add concealed Bcc recipients or spoof the apparent sender.
What can be done if updating is not immediately possible?
Restrict Author-level and higher accounts to trusted users, and prevent untrusted users from changing the notification sender-name setting. Review the setting for newline characters and unexpected values.