CVE-2026-86813
Received Received - Intake

MetForm WordPress Plugin Email Header Injection Vulnerability

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-86813
EUVD
EUVD-2026-76041

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpmet metform 4.1.9
metform metform to 4.1.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MetForm WordPress plugin before version 4.1.9 has a flaw where user-submitted values are not properly sanitized for newline characters. This allows attackers to inject additional email headers, such as Bcc, into notification emails when a field value is set to populate a header.

Detection Guidance

To detect this vulnerability, check if your MetForm WordPress plugin version is below 4.1.9. You can do this by logging into your WordPress admin panel, navigating to the plugins section, and looking for MetForm. If an update is available, it indicates your version is outdated.

Impact Analysis

An attacker could exploit this to send emails with additional recipients without your knowledge, potentially leading to information leaks or spam. The attack requires no authentication and can be performed remotely.

Compliance Impact

This vulnerability could lead to unauthorized data exposure if email headers are manipulated to send sensitive information to unintended recipients, potentially violating GDPR or HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Immediately update the MetForm plugin to version 4.1.9 or later through your WordPress admin panel. If you cannot update immediately, consider disabling the plugin temporarily until you can apply the patch to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86813. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart