CVE-2026-86813

The record

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.

Affected packages

Related vulnerabilities

• CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
• CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
• CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
• CVE-2026-48019 Laravel is a web application framework. CWE-93
• CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… CWE-93
• CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. CWE-93
• CVE-2026-84372 Predis is a flexible and feature-complete Redis and Valkey client for PHP. CWE-93