CVE-2026-0673

This is a WordPress plugin email header injection vulnerability (CVE-2026-0673) with a CVSS 5.3 that almost certainly understates its practical impact. The technical flaw is straightforward—failure to sanitize newlines in email header inputs—but where defenders should focus attention is on what happens after the injection succeeds, because that's where the CVSS model breaks down. The compound risk isn't the injection itself; it's what the attacker can do with a compromised mail relay that carries the domain's trusted reputation. Injecting arbitrary headers means setting From addresses to the legitimate domain, BCCing the attacker on every submission, or manipulating Reply-To to intercept responses. Modern email authentication (SPF, DKIM, DMARC) verifies where mail originated—it doesn't verify header integrity. So a contact form submission that injects a spoofed From address still passes authentication checks because it genuinely originates from the server. That trusted relay is the attack surface. Two things compound the severity further. First, WordPress contact forms are trust anchors. Users have been conditioned to treat submissions through a site's contact form as legitimate business communication. An email arriving 'from' a company's domain via their own server carries organizational trust that no spam filter can programmatically replicate. Second, this vulnerability exists in a plugin ecosystem with high abandonment rates. The version range 'all versions up to 8.3.15' spans years of releases, and many installations sit on sites where the maintainer has moved on—no patch is coming, and the operators may not even know the plugin is installed. What to do: First, verify whether your plugin uses wp_mail() with header arrays (the safe approach) or string concatenation (vulnerable). If string concatenation, patch immediately. Second, audit your mail relay configuration—restrict relay volume, strip BCC headers if possible, and review DMARC policy to reject spoofed From addresses even when origination passes. Third, treat contact form submissions in your logging and monitoring as higher-risk traffic; anomalous patterns (unusual volume, unexpected recipients) warrant investigation. Fourth, inventory your WordPress plugin inventory for abandoned or unmaintained components—this vulnerability will persist in the wild long after patches exist because the remediation window closes faster than disclosure reaches abandoned sites.

Reviewed through automated stages and approved by a human before publication.