CVE-2026-91831 Overview
CVE-2026-91831 affects the Subscribe to Comments WordPress plugin before version 2.3.3. The plugin fails to sanitise newline characters from the notification sender-name setting before placing it into e-mail headers. Users with Author-level access or higher can inject arbitrary e-mail headers, including hidden Bcc recipients, and spoof the sender identity. The flaw is classified as [CWE-93] Improper Neutralization of CRLF Sequences.
Critical Impact
Authenticated contributors can abuse the plugin's e-mail notification system to send spoofed messages and silently exfiltrate notification copies to attacker-controlled addresses.
Affected Products
- Subscribe to Comments WordPress plugin versions prior to 2.3.3
- WordPress sites allowing Author-level or higher accounts
- Any site relying on the plugin's notification sender-name configuration
Discovery Timeline
- 2026-10-19 - CVE CVE-2026-91831 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-91831
Vulnerability Analysis
The plugin stores an administrator-configurable sender-name used in outbound comment-subscription notifications. The code concatenates this value directly into the From: header of outgoing mail without stripping carriage return (\r) or line feed (\n) characters. Because SMTP headers are newline-delimited, injecting a \r\n sequence terminates the current header and begins a new one of the attacker's choosing.
An authenticated user with Author permissions or above can modify the sender-name field through the plugin's settings interface. By embedding CRLF sequences followed by headers such as Bcc: or a replacement From:, the attacker causes WordPress's wp_mail() function to emit malformed outbound messages. Recipients see a spoofed sender, and silent copies reach addresses the site owner never approved.
Root Cause
The root cause is missing input sanitisation on the sender-name setting. The plugin trusts the stored value and interpolates it into mail headers without calling WordPress helpers such as sanitize_text_field() or stripping control characters. [CWE-93] covers this class of CRLF injection flaw.
Attack Vector
Exploitation requires authenticated access at Author privilege level or higher, which raises the attack bar on well-managed sites but remains reachable on multi-author blogs and content platforms. The attacker updates the sender-name setting with a payload containing CRLF followed by injected headers. Each subsequent notification e-mail dispatched by the plugin carries the attacker-controlled headers. Full exploitation details are available in the WPScan Vulnerability Report.
No verified public proof-of-concept code is available at this time. See the WPScan advisory for additional technical context.
Detection Methods for CVE-2026-91831
Indicators of Compromise
- Outbound e-mail from the WordPress site containing unexpected Bcc: recipients not present in plugin configuration.
- Notification messages displaying a From: address that differs from the site's configured sender identity.
- Plugin option values for the sender-name setting containing %0d, %0a, or literal CRLF characters.
Detection Strategies
- Audit the wp_options table for the Subscribe to Comments sender-name entry and flag any value containing newline characters or additional header tokens such as Bcc:, Cc:, or Content-Type:.
- Monitor SMTP relay logs for messages originating from the WordPress host that include blind-carbon-copy recipients outside the organisation.
- Review WordPress audit logs for Author or Editor accounts modifying plugin settings outside of normal administrative workflows.
Monitoring Recommendations
- Enable mail-gateway logging that captures full header sets, not just envelope data, so injected headers remain visible.
- Alert on sender-name field edits performed by non-administrator roles.
- Correlate unusual notification volume with recent plugin configuration changes.
How to Mitigate CVE-2026-91831
Immediate Actions Required
- Upgrade the Subscribe to Comments plugin to version 2.3.3 or later on all WordPress sites.
- Review the current sender-name setting and reset it to a known-good value that contains no newline characters.
- Audit Author, Editor, and Administrator accounts for unauthorised recent logins or setting changes.
Patch Information
The maintainers resolved the issue in Subscribe to Comments version 2.3.3 by sanitising the sender-name value before it reaches the mail header assembly logic. Site operators should apply the update through the WordPress plugin manager. Verify the installed version in the WordPress admin dashboard after updating.
Workarounds
- Restrict plugin settings access by limiting the number of Author-level and above accounts on the site.
- Deactivate the Subscribe to Comments plugin until the patched release can be deployed.
- Route outbound WordPress mail through an SMTP relay that strips or rejects messages containing suspicious header patterns.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
