CVE-2026-12127: WPForms CRLF Injection in Email Headers – Blind-Copy Data Exfiltration

Technical summary

CVE-2026-12127 is a CRLF injection vulnerability (CWE-93) in the WPForms plugin's get_reply_to_address() function. The vulnerability occurs because the function processes Reply-To display names using smart-tag expansion with the 'notification' context instead of the stricter 'notification-reply-to' context, bypassing email validation. The wpforms_sanitize_textarea_field() function intentionally preserves carriage return (CR) and line feed (LF) characters for legitimate textarea content, but these characters are never stripped before the display name is concatenated directly into the raw Reply-To: mail header. This allows an attacker to inject CRLF sequences followed by malicious headers (e.g., Bcc: [email protected]) into the email header structure. Exploitation requires that a form notification be configured to use a Paragraph Text (textarea) smart tag as the Reply-To display name, a plausible real-world configuration in forms that dynamically populate sender metadata from user input.

Business impact

This vulnerability enables data exfiltration from form submissions without detection. Organizations using WPForms may unknowingly leak sensitive form data—including customer inquiries, support requests, payment-related information, or survey responses—to attacker-controlled email accounts. The lack of visibility into the blind-copy makes detection difficult; notification emails appear to send normally to the intended recipient while copies are silently diverted. For businesses reliant on form data for customer engagement, compliance, or decision-making, this represents both a privacy breach and potential regulatory exposure, particularly under GDPR, CCPA, or similar data protection regimes that mandate awareness of data flows.

Affected systems

All versions of the WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin up to and including version 1.10.2 are vulnerable. The vulnerability affects any WordPress installation running an affected version of WPForms where a form notification is configured to use a Paragraph Text field as the Reply-To display name via a smart tag (e.g., {field_name}). This is a common pattern for dynamic form configurations where user-submitted data populates email metadata. The vulnerability is not marked as actively exploited in the CISA KEV catalog as of the publication date.

Exploitability

Exploitation requires minimal prerequisites and can be carried out by unauthenticated actors. An attacker needs only to identify a WordPress site using WPForms and locate a form whose notification settings use a textarea field smart tag for the Reply-To display name—a configuration that is likely to occur in real-world deployments seeking flexible email routing. The attacker then crafts a form submission containing CRLF sequences (\r\n) followed by header injection payload (e.g., \r\nBcc: [email protected]) in the textarea field. No authentication, special privileges, or user interaction beyond standard form submission is required. The attack is reliable and deterministic once the vulnerable configuration is identified.

Remediation

Upgrade the WPForms plugin to a patched version beyond 1.10.2. Verify the specific patched version number in the official WPForms security advisory or your WordPress plugin dashboard. As an interim mitigation, audit all form notifications to identify those using textarea-based smart tags in the Reply-To display name field and temporarily reconfigure them to use static values or alternative smart tags that do not derive from user input. Additionally, configure mail server settings to enforce strict header validation and filter CRLF sequences at the server level if the mail service supports header filtering.

Patch guidance

Check the WPForms plugin update mechanism in your WordPress admin dashboard for availability of a security patch. Verify against the official WPForms security advisory for the specific version number that addresses CVE-2026-12127. Once a patched version is confirmed available, test in a staging environment to ensure compatibility with your form configurations and any custom smart-tag implementations before deploying to production. If automatic updates are not enabled, manually trigger the update from Plugins > Installed Plugins after confirming patch availability.

Detection guidance

Review form notification configurations in WPForms settings to identify any that use Paragraph Text (textarea) field smart tags in the Reply-To display name. Audit mail server logs for unexpected Bcc: headers or evidence of email redirection to unauthorized addresses. Monitor SMTP/mail gateway logs for anomalous CRLF sequences in email header fields, particularly in form notification submissions. If your site logs form submissions, examine textarea field content for CRLF byte sequences (0x0D0x0A) which may indicate exploit attempts. Consider enabling email header logging on your mail server to capture raw SMTP traffic for forensic analysis.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.3) due to limited attack scope and lack of system compromise, the vulnerability should be prioritized for patching due to its ease of exploitation and the silent nature of data exfiltration. Unlike attacks that trigger visible errors or performance degradation, CRLF injection in email headers leaves minimal forensic traces. Organizations managing sensitive form data—particularly those in regulated industries—should treat this as a data confidentiality risk and patch promptly.

Risk score, explained

The CVSS 5.3 score reflects a network-accessible vulnerability (AV:N) requiring no privileges (PR:N) or user interaction (UI:N) that results in a low integrity impact (I:L) without confidentiality loss or availability disruption at the system level. However, the integrity impact is rated 'Low' rather than reflecting the full scope of data exposure because the attack compromises the integrity of email routing and header structure rather than the integrity of the form submission data itself. Organizations should consider raising their internal risk rating if forms handle regulated or sensitive personal data, as the practical impact of silent data diversion exceeds the technical CVSS rating.

Frequently asked questions