CVE-2026-91831
Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
Unknown Subscribe to Comments
CVSS
3.8LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.3Subscribe to CommentsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
Text from CVE List
Affected versions 1
- Subscribe to Commentsaffected: 2.3 before 2.3.3CVE List