CVE-2026-91831

LowCVSS 3.8

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers. This allows users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

Risk Assessment

Users with Author-level access can send forged e-mails and hide recipients, which may be used for phishing or spam. This undermines trust in site communications.

Recommendation

Update the Subscribe to Comments plugin to version 2.3.3 or later. Limit Author-level accounts to the minimum necessary.

Other vulnerabilities in Subscribe to Comments WordPress plugin

CVE-2026-91830Medium
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

Original NVD description (English source)

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS