Is CVE-2026-91831 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91831?

CVE-2026-91831 has a CVSS v3 severity of LOW (3.8).

Back

CVE-2026-91831

Description

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.