CVE-2026-12127: WPForms Plugin CRLF Injection Vulnerability

CVE-2026-12127 Overview

CVE-2026-12127 is a CRLF (Carriage Return Line Feed) injection vulnerability in the WPForms plugin for WordPress, affecting all versions up to and including 1.10.2. The flaw resides in the get_reply_to_address() function, which processes the Reply-To display name through smart-tag expansion using the 'notification' context instead of 'notification-reply-to'. This bypasses email-address validation while wpforms_sanitize_textarea_field() preserves CR/LF characters. Unauthenticated attackers can inject arbitrary email headers such as Bcc: into outgoing notification emails, silently blind-copying notifications to an attacker-controlled address. The issue is classified under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Unauthenticated attackers can inject Bcc headers into WPForms notification emails, exfiltrating sensitive form submission content to arbitrary recipients without administrator awareness.

Affected Products

WPForms Lite for WordPress — all versions up to and including 1.10.2
WPForms — Easy Form Builder plugin (Contact Forms, Payment Forms, Surveys)
Fixed in WPForms 1.10.2.1

Discovery Timeline

2026-07-01 - CVE-2026-12127 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12127

Vulnerability Analysis

The vulnerability originates in how WPForms constructs the Reply-To: mail header for outbound notification emails. When a form notification is configured with a Paragraph Text (textarea) field mapped to the Reply-To display name through a Smart Tag, user-supplied content flows into the header without CR/LF stripping. The mailer then concatenates this content directly into the raw SMTP header string, allowing header boundaries to be broken.

Because the injection occurs in an outbound header sent to the mail transport, an attacker submitting a public form can add additional headers such as Bcc: to redirect a hidden copy of every notification email. Site owners retain no indication that submission data is being silently exfiltrated to an external mailbox.

Root Cause

The root cause is a mismatched smart-tag context. In get_reply_to_address(), the display name portion of the Reply-To header is expanded with context 'notification' rather than 'notification-reply-to'. The 'notification-reply-to' context enforces email-address validation and neutralizes control characters, while the 'notification' context does not. Compounding the issue, wpforms_sanitize_textarea_field() intentionally preserves newline characters to keep textarea content readable, and no downstream sanitization removes CR/LF before the value is concatenated into the header string.

Attack Vector

Exploitation requires that a target site operator has configured a form notification to reference a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag. An unauthenticated remote attacker submits the public form with a payload containing CRLF sequences followed by an injected header, for example an added Bcc: line pointing to an attacker-controlled address. When the notification email is sent, the injected header is honored by the mail transport, and a silent blind carbon copy of the notification is delivered to the attacker.

The vulnerability manifests in the smart-tag expansion flow in class-textarea.php and the header assembly in src/Emails/Mailer.php and src/Emails/Notifications.php. See the Wordfence Vulnerability Report and the WordPress ChangeSet Mailer Update for the technical fix.

Detection Methods for CVE-2026-12127

Indicators of Compromise

Notification emails whose raw source contains additional Bcc:, Cc:, or X- headers not configured by the site administrator.
Form submissions where a Paragraph Text field value contains encoded or literal \r\n sequences followed by header-like tokens (Bcc:, Content-Type:).
Outbound SMTP traffic from the WordPress host delivering copies of notifications to unknown external domains.
WPForms entries with abnormally long textarea values mapped to a Reply-To Smart Tag.

Detection Strategies

Inspect the WordPress wp_mail() logs or SMTP relay logs for messages containing multiple recipients when only one was configured.
Parse WPForms entry storage for CRLF byte sequences (0x0D 0x0A) inside textarea fields referenced by notification Smart Tags.
Audit form notification settings for any Reply-To display name that resolves through a Smart Tag to a Paragraph Text field.
Compare envelope recipients recorded by the mail transport against the recipients configured in each WPForms notification.

Monitoring Recommendations

Enable full SMTP header logging on the WordPress mail transport and alert on outbound Bcc: headers to non-approved domains.
Monitor WPForms plugin version across the estate and alert on hosts running 1.10.2 or earlier.
Review web access logs for POST requests to /wp-json/wpforms/ and admin-ajax.php?action=wpforms_submit containing URL-encoded %0D%0A sequences.

How to Mitigate CVE-2026-12127

Immediate Actions Required

Update WPForms and WPForms Lite to version 1.10.2.1 or later on all WordPress sites.
Audit every form notification and remove Paragraph Text (textarea) Smart Tags from the Reply-To display name field until patching is confirmed.
Rotate any credentials or sensitive data that may have been transmitted through WPForms notifications during the exposure window.
Review outbound mail logs for the last 90 days for unauthorized Bcc: recipients.

Patch Information

WPForms addressed the vulnerability in version 1.10.2.1. The fix strips CR/LF characters from the Reply-To display name before header assembly and corrects the smart-tag context to 'notification-reply-to', restoring email-address validation. Refer to the WordPress ChangeSet Version Update for the full diff.

Workarounds

Reconfigure affected notifications to use email-only fields for the Reply-To value rather than Paragraph Text Smart Tags.
Apply a Web Application Firewall (WAF) rule blocking form submissions containing raw or URL-encoded CRLF sequences (%0D%0A) in textarea parameters.
Restrict the WordPress site's outbound SMTP relay to allow-listed recipient domains where feasible.

bash

# Example WAF rule (ModSecurity) to block CRLF in WPForms textarea submissions
SecRule REQUEST_URI "@rx (wpforms|admin-ajax\.php)" \
  "chain,phase:2,deny,status:400,id:1012127,\
   msg:'CVE-2026-12127 CRLF injection attempt in WPForms submission'"
  SecRule ARGS "@rx (?:%0[dD]%0[aA]|\r\n)(?:bcc|cc|content-type|to):" \
    "t:none,t:lowercase"