Email Header Injection Issue in Subscribe to Comments Plugin by WordPress
CVE-2026-91831

3.8LOW

Key Information:

Vendor

WordPress
Status
Subscribe To Comments
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-91831?

The Subscribe to Comments plugin for WordPress, prior to version 2.3.3, is susceptible to an email header injection vulnerability. This issue arises because the plugin does not properly sanitize newline characters in the sender-name setting used in email headers. As a result, users with Author-level access or higher are able to inject arbitrary email headers, which can include hidden Bcc fields and allow for sender spoofing. This vulnerability poses a significant risk as it can facilitate phishing attacks and compromise the integrity of email communications from affected WordPress sites.

Affected Version(s)

Subscribe to Comments 2.3 < 2.3.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-91831 - Proof of Concept

References

https://wpscan.com/vulnerability/6cd60f78-f5e2-4b4a-8d50-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Het Kalariya
WPScan
.