CRLF Injection in Pagelayer Drag and Drop Website Builder Plugin for WordPress

CVE-2026-2442

What is CVE-2026-2442?

The Pagelayer plugin, a drag-and-drop website builder for WordPress, contains a vulnerability allowing for CRLF injection. This issue arises from its contact form handler, which incorrectly processes user input from form fields. Specifically, it replaces placeholders in email headers without sanitizing CR and LF characters. As a result, unauthorized attackers can craft malicious inputs that allow them to inject arbitrary email headers, including Bcc and Cc fields, thereby exploiting the email delivery process of the contact forms configured with these placeholders.

References