CVE-2026-86813: MetForm WordPress Email Header Injection

CVE-2026-86813 Overview

CVE-2026-86813 is an email header injection vulnerability in the MetForm WordPress plugin versions before 4.1.9. The plugin fails to neutralize newline characters (CRLF) in user-submitted values that get placed into notification email headers. Unauthenticated attackers can inject arbitrary headers, such as Bcc or Cc, into emails sent by the affected site. This weakness is classified as [CWE-93] Improper Neutralization of CRLF Sequences.

Critical Impact
Unauthenticated attackers can hijack outbound notification emails to exfiltrate content, distribute spam, or conduct phishing under the trusted domain of the affected WordPress site.

Affected Products

MetForm WordPress plugin versions prior to 4.1.9
WordPress sites using MetForm with fields configured to populate email headers
Notification email workflows relying on unsanitized submitted form values

Discovery Timeline

2026-09-11 - CVE-2026-86813 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-86813

Vulnerability Analysis

The vulnerability exists in MetForm's notification email construction logic. When a form field value is designated to populate an email header, such as From, Reply-To, or Subject, the plugin passes the submitted value directly into the header without stripping CRLF sequences (\r\n).

Email header parsing treats CRLF as a delimiter between distinct headers. An attacker who submits a value containing a newline followed by another header name can append arbitrary headers to the outbound message. This is a classic header injection pattern tracked under [CWE-93].

The attack requires no authentication because MetForm forms are typically exposed to unauthenticated site visitors. Complexity is elevated because the target form must be configured to route a submitted value into a header field.

Root Cause

The root cause is missing input validation on form field values that are concatenated into email header fields. The plugin does not strip or reject carriage return and line feed characters before passing values to the mail transport layer. Any field mapped to a header becomes an injection sink.

Attack Vector

An attacker submits a form field containing an embedded newline followed by a forged header. For example, a value passed into the From header could be terminated with \r\n and followed by Bcc: attacker@example.com. The mail transport then emits the additional header, silently copying the attacker on notification traffic. Attackers can also inject Subject overrides or additional message bodies via Content-Type manipulation.

Detection Methods for CVE-2026-86813

Indicators of Compromise

Outbound emails from the WordPress site containing unexpected Bcc or Cc recipients not present in plugin configuration
Web server access logs showing form POST requests with URL-encoded %0d%0a or %0a sequences in field values
Mail server logs recording unusually high recipient counts on notification messages originating from the site
Spam or phishing complaints referencing the site domain as sender

Detection Strategies

Inspect HTTP request bodies to MetForm submission endpoints for CRLF sequences and header keywords such as Bcc:, Cc:, or Content-Type:
Correlate WordPress plugin version telemetry with MetForm versions below 4.1.9 during asset inventory scans
Alert on outbound SMTP transactions from the site where the recipient set differs from the configured notification list

Monitoring Recommendations

Enable verbose mail transport logging on the WordPress host to capture full header sets for notification emails
Deploy a web application firewall rule that rejects submissions containing raw or encoded CRLF in form fields
Baseline notification email volume and recipient patterns, then alert on deviations

How to Mitigate CVE-2026-86813

Immediate Actions Required

Upgrade the MetForm plugin to version 4.1.9 or later on all WordPress installations
Audit MetForm form configurations and remove user-controlled field mappings to email header fields where not strictly required
Review outbound mail logs for the past 90 days to identify prior injection attempts and unauthorized recipients

Patch Information

The vendor addressed the vulnerability in MetForm version 4.1.9 by properly neutralizing newline characters in submitted values used within email headers. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable or reconfigure any MetForm form that maps unauthenticated user input into email header fields
Place a WAF rule in front of /wp-admin/admin-ajax.php and MetForm submission endpoints to block CRLF injection payloads
Restrict outbound SMTP recipients at the mail relay to an approved allowlist until the patch is applied

bash

# Example WAF rule (ModSecurity) to block CRLF in form submissions
SecRule ARGS "@rx (?:%0[ad]|\r|\n)" \
  "id:1008613,phase:2,deny,status:400,\
  msg:'CRLF injection attempt in form field (CVE-2026-86813)'"