CVE-2026-12127

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers to inject arbitrary additional email headers — such as `Bcc:` — into outgoing notification emails, silently blind-copying all notification email copies to an attacker-controlled address. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.

• CWE-93

• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/includes/fields/class-textarea.php#L326
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Mailer.php#L368
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1098
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.2/src/Emails/Notifications.php#L1138
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/includes/fields/class-textarea.php#L326
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Mailer.php#L368
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1098
• https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.1.1/src/Emails/Notifications.php#L1138
• https://plugins.trac.wordpress.org/changeset/3586095/wpforms-lite/trunk/src/Emails/Mailer.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpforms-lite/tags/1.10.2&new_path=%2Fwpforms-lite/tags/1.10.2.1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a51c22-c4ca-4897-ad7e-c5df00b07fe0?source=cve

Published

Jul 1, 2026

Last Modified

Jul 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121260A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 20…9.1
• CVE-2026-121261A vulnerability has been found in phpMyAdmin ShapeFile up to…4.3
• CVE-2026-121262A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0…5.3
• CVE-2026-121263A vulnerability was determined in phpMyAdmin MoTranslator up…6.3
• CVE-2026-121265SQL::Abstract versions before 2.000003 for Perl allow SQL in…9.8
• CVE-2026-121267Incorrect default permissions vulnerability in TÜBİTAK BİLGE…7.8
• CVE-2026-12128The Pinpoint Booking System – Version 2 plugin for WordPress…5.3
• CVE-2026-121286On affected platforms running Arista EOS in multi-agent rout…6.5
• CVE-2026-121287An unauthenticated attacker on an adjacent network segment c…8.8
• CVE-2026-121288An unauthenticated attacker on an adjacent network segment c…8.1
• CVE-2026-121289On affected platforms running Arista EOS with BGP configured…9.8
• CVE-2026-12129A vulnerability was identified in CodeAstro Human Resource M…3.5