{"id":"CVE-2026-91831","aliases":["EUVD-2026-104101","GHSA-fwc8-9qp3-8f5c"],"status":"published","title":"Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00161,"percentile":0.0534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-93"],"published":"2026-10-19T06:46:17Z","modified":"2026-10-19T21:02:51Z","products":[{"vendor":"markjaquith","product":"subscribe to comments"},{"vendor":"unknown","product":"subscribe to comments"}],"references":[{"url":"https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-7d2bc4f981ee/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91831"},{"url":"https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-7d2bc4f981ee"},{"url":"https://github.com/advisories/GHSA-fwc8-9qp3-8f5c"}],"sources":{"cve":[{"id":"CVE-2026-91831","title":"Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","status":"published","published":"2026-10-19T06:46:17.28Z","modified":"2026-10-19T09:31:21.214Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:19:53.115938Z"}],"euvd":[{"id":"EUVD-2026-104101","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","status":"published","published":"2026-10-19T06:46:17Z","modified":"2026-10-19T09:31:21Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:51.629031Z"}],"ghsa":[{"id":"GHSA-fwc8-9qp3-8f5c","title":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from...","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","status":"published","published":"2026-10-19T09:32:30Z","modified":"2026-10-19T12:32:47Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:13:56.45986Z"}],"nvd":[{"id":"CVE-2026-91831","description":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","status":"published","published":"2026-10-19T07:16:32.187Z","modified":"2026-10-19T21:02:51.987Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:13:00.83844Z"}]}}