Description

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-06T10:17:14.563Z",
  "pubdate": "2026-09-06T10:17:14.563Z",
  "executiveSummary": "The JetFormBuilder WordPress plugin, in versions prior to 3.6.5.2, is susceptible to an Email Header Injection vulnerability. This flaw arises from insufficient input validation and sanitization of user-supplied data used in email headers.\nSpecifically, the plugin fails to strip carriage return (CR) and line feed (LF) characters from address fields sourced directly from user form submissions before incorporating them into the email transmission process. An unauthenticated attacker can exploit this vulnerability to inject arbitrary SMTP headers, including Bcc or Cc fields, facilitating spam relay, sender spoofing, or the delivery of unauthorized content to additional recipients.\nThe vulnerability is present when the site configuration designates a form-sourced field for email headers. Successful exploitation allows an attacker to manipulate the delivery path and appearance of automated emails sent by the platform. Mitigation requires an immediate update to the specified version or higher, as the issue presents a significant risk to organizational email reputation and security policy compliance.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization of user input within the mail-handling logic of the JetFormBuilder plugin. In versions 3.6.5.2 and earlier, the plugin dynamically constructs email headers using data provided by users via form fields. Because the application fails to validate or sanitize these fields for injection characters—specifically %0d (CR) and %0a (LF)—an attacker can manipulate the structure of the resulting SMTP message.\nThe attack flow begins with the submission of a crafted form entry where the 'address' field contains malicious CRLF sequences followed by additional SMTP header directives. For example, a payload formatted as 'attacker@example.com%0d%0aBcc: victim@target.com' forces the underlying mail function to interpret the injected 'Bcc' directive as a legitimate header entry.\nWhen the plugin processes this input and invokes the underlying WordPress wp_mail() function or a related mail transport method, the injected characters terminate the intended header and initiate a new one. Consequently, the mail transport agent processes the added headers, causing the application to transmit copies of the email to unintended recipients, effectively turning the vulnerable site into an unwitting participant in phishing campaigns or spam distribution.\nExploitation is feasible for unauthenticated users, as it relies on interacting with a public-facing web form. The requirement for success is that the JetFormBuilder configuration must be set to dynamically pull recipient or sender information from user-submitted fields. Because the server trusts the form input during the email construction phase without implementing allow-lists or character filtering, the application fails to distinguish between data and control characters. Post-exploitation impact includes potential sender domain blacklisting, successful delivery of malicious content through legitimate channels, and the bypass of security filters that inspect sender authenticity."
}