Description

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-11T11:16:57.267Z",
  "pubdate": "2026-09-11T11:16:57.267Z",
  "executiveSummary": "The MetForm WordPress plugin, in versions prior to 4.1.9, contains a critical vulnerability categorized as Email Header Injection (CWE-80). This security flaw arises from the improper sanitization of user-supplied data that is subsequently utilized within the construction of notification email headers.\nUnauthenticated remote attackers can exploit this vulnerability by injecting arbitrary newline characters (CRLF sequences) into form fields configured to populate outgoing email headers. By successfully manipulating the header structure, an attacker can append malicious headers, such as 'Bcc', 'Cc', or 'Reply-To'.\nThe impact of this vulnerability includes potential unauthorized information disclosure, mass phishing campaigns, and server reputation damage due to spam relaying. The vulnerability allows for the manipulation of communication workflows initiated by the WordPress site, potentially leading to the leakage of administrative emails or sensitive notification traffic. There are no authentication requirements to execute this attack, as the injection occurs via publicly accessible web forms. The primary risk is the loss of integrity regarding the site's automated messaging systems and the potential for the server to be blacklisted by mail service providers due to abusive relay patterns.",
  "technicalDetails": "The vulnerability originates from the plugin's failure to neutralize control characters, specifically carriage return (CR) and line feed (LF) characters, within data captured from user-submitted form fields. In the context of the MetForm plugin, certain form elements are configurable to populate specific headers of the email generated upon submission. The underlying code fails to validate these inputs before concatenating them into the header string passed to the PHP mail() function or the WordPress wp_mail() wrapper.\nThe exploitation mechanism relies on CRLF injection. In SMTP and email protocols, headers are delimited by a CRLF sequence (\\r\\n). When the application takes untrusted input—such as a user-provided string in a form field—and appends it directly to the email header block without stripping newline characters, an attacker can terminate the intended header and initiate a new one.\nAn attack flow follows this sequence: First, the attacker identifies a form managed by MetForm where a user-submitted value is mapped to an email header field. Second, the attacker crafts a malicious payload containing newline characters followed by target headers. For instance, if an input field is mapped to the 'Subject' header, the attacker submits a payload structured like 'Subject_Value\\r\\nBcc: victim@example.com'. Third, the server processes this input and reconstructs the email headers, inadvertently treating the 'Bcc' directive as a legitimate command.\nAs a result, the SMTP server receives a modified header block containing the injected commands. When the site dispatches the notification email, the mail server honors the injected 'Bcc' header, causing a hidden copy of the administrative notification to be delivered to an arbitrary third-party address. This process bypasses the intended notification flow and demonstrates a failure in input sanitization logic within the component handling email delivery configuration.\nThis vulnerability is restricted to versions of MetForm prior to 4.1.9. Because the vulnerability exists at the application layer and is reachable through standard public-facing forms, no prior authentication or administrative privileges are required. The network exposure is broad, as any accessible form on the WordPress site that utilizes this dynamic header functionality serves as a potential vector. Successful exploitation essentially permits the attacker to hijack the email functionality of the compromised server, potentially leading to further phishing or social engineering attacks against the site's user base."
}