CVE-2026-19862: JetFormBuilder Email Header Injection Flaw

CVE-2026-19862 Overview

CVE-2026-19862 is an email header injection vulnerability in the JetFormBuilder WordPress plugin before version 3.6.5.2. The plugin fails to validate or strip line breaks from address values sourced from submitted form fields before adding them to email headers. Unauthenticated users can inject arbitrary email headers, add hidden recipients, and spoof the sender. Exploitation requires the site to be configured so at least one of the message's addresses is populated from a form field. The flaw is classified as [CWE-93] Improper Neutralization of CRLF Sequences.

Critical Impact
Unauthenticated attackers can inject arbitrary email headers, silently add BCC recipients, and forge sender addresses through vulnerable JetFormBuilder submission forms.

Affected Products

JetFormBuilder WordPress plugin versions prior to 3.6.5.2
WordPress sites with JetFormBuilder forms configured to pull email addresses from user-submitted fields
Any downstream integrations that rely on the plugin's outbound email for notifications

Discovery Timeline

2026-09-06 - CVE-2026-19862 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19862

Vulnerability Analysis

JetFormBuilder builds outbound notification emails using values submitted through public-facing forms. When an address field (such as To, From, Reply-To, or CC) is populated from user input, the plugin concatenates that value into the email header block without neutralizing carriage return (\r) or line feed (\n) sequences. An attacker who submits a crafted address containing CRLF characters can terminate the current header and append attacker-controlled headers to the outgoing message.

The impact includes silent duplication of messages to attacker-controlled inboxes, sender spoofing that undermines recipient trust, and injection of additional MIME parts that can carry phishing payloads. Because JetFormBuilder is a widely deployed form builder, the vulnerability broadens the attack surface for phishing campaigns launched from legitimate WordPress domains, which typically pass sender reputation checks.

Root Cause

The root cause is missing input neutralization on address fields prior to header assembly. The plugin trusts the submitted string and does not strip or reject \r\n, %0d%0a, or equivalent encoded sequences. This is the classic CRLF injection pattern described by [CWE-93].

Attack Vector

The attack is network-based and requires no authentication or user interaction. However, exploitation requires the target site to be configured with a form where an email header address is sourced from a form field. An attacker submits the vulnerable form with an address value that embeds CRLF sequences followed by additional headers such as Bcc:, From:, or a new message body. The plugin passes the crafted string into the mail transport, and the SMTP layer honors the injected headers.

Refer to the WPScan Vulnerability Report for the technical writeup and reproduction details.

Detection Methods for CVE-2026-19862

Indicators of Compromise

Outbound email logs showing Bcc, Cc, or From headers that do not match the site's configured notification template.
Form submission POST requests containing URL-encoded CRLF sequences (%0d%0a, %0A, %0D) in address fields.
Sudden increase in bounce messages or abuse complaints originating from the WordPress site's mail relay.
Web server access logs recording repeat submissions to JetFormBuilder endpoints from a single source.

Detection Strategies

Inspect HTTP request bodies to JetFormBuilder handlers for newline characters or MIME boundary markers embedded in address parameters.
Correlate WordPress form submissions with SMTP relay logs to identify messages containing unexpected recipients.
Deploy WAF rules that flag CRLF byte sequences within parameters named email, to, from, reply_to, or similar.

Monitoring Recommendations

Enable verbose SMTP logging on the mail transport used by WordPress and retain headers for at least 30 days.
Alert on outbound messages where the recipient count exceeds the expected value for a given form workflow.
Track the installed version of JetFormBuilder across managed WordPress fleets and alert on any instance below 3.6.5.2.

How to Mitigate CVE-2026-19862

Immediate Actions Required

Update JetFormBuilder to version 3.6.5.2 or later on all WordPress installations.
Audit existing forms and remove any configuration that sources email header addresses (To, From, Reply-To, CC, BCC) from user-submitted fields.
Review outbound mail logs for the past 90 days to identify potential abuse.

Patch Information

The vendor addressed the issue in JetFormBuilder version 3.6.5.2 by validating and stripping line-break characters from address values before they are placed into email headers. Administrators should apply the update through the WordPress plugin manager or by downloading the fixed release directly. See the WPScan Vulnerability Report for advisory details.

Workarounds

Reconfigure affected forms to use hard-coded email addresses in the notification action rather than pulling from submitted fields.
Deploy a WAF rule that rejects form submissions containing \r, \n, %0d, or %0a in any field mapped to an email header.
Restrict outbound SMTP to a filtering relay that enforces envelope-sender allowlists and rejects malformed headers.

bash

# Example ModSecurity rule blocking CRLF in email form fields
SecRule ARGS_NAMES "@rx (?i)(email|to|from|reply.?to|cc|bcc)" \
    "chain,id:1009862,phase:2,deny,status:400,\
    msg:'CRLF injection attempt in email field (CVE-2026-19862)'"
    SecRule ARGS "@rx (\r|\n|%0d|%0a)" "t:lowercase"