CVE-2026-91831

CVE-2026-91831 · Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

CVSS 3.8 · Low · EPSS 0.2% · Fix available

Published

2026-10-19T06:46:17.280Z

Updated

2026-10-19T09:31:21.214Z

Check your server →