Live › vulnerability › CVE-2026-91831
Go to dashboardThe Subscribe to Comments WordPress plugin before 2.3.3 does not strip newline characters from its notification sender-name setting before placing it in email headers. An author-level user can inject extra headers such as a hidden Bcc or a spoofed sender.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Subscribe to Comments plugin before 2.3.3 that have users with Author role or above. The exposure depends on those users being able to edit the sender-name setting, so sites with only administrators or no multi-user publishing can deprioritise this. Sites that do not use the plugin can skip it.
No product ranges from the sources yet.
wp plugin get subscribe-to-comments --field=version2.3.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
This page as .md · .json · in your agent: get_signal("CVE-2026-91831")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.