CVE-2026-86813

Executive Summary

CVE-2026-86813 is an unauthenticated email header injection vulnerability in the MetForm WordPress plugin affecting all versions before 4.1.9. The plugin fails to neutralize newline characters in user-submitted field values that are subsequently placed into notification email headers, allowing an attacker to append arbitrary headers such as Bcc. Although exploitability is constrained by the requirement that an administrator has configured a submitted field value to populate an email header — hence the High Attack Complexity (AC:H) rating — successful exploitation enables email spoofing/relay abuse, spam distribution from the victim's mail infrastructure, and potential leakage of notification content to attacker-controlled addresses. There is currently no public proof-of-concept, no Nuclei template, no CISA KEV listing, and no verified patch evidence from tracked sources.

Technical Analysis

The vulnerability class is email header injection (CRLF injection / SMTP header injection), classified here as CWE-93 (Improper Neutralization of CRLF Sequences, i.e., "CRLF Injection"). Unlike command injection or SQL injection, the injection primitive operates at the level of email message construction: the plugin takes values submitted through a public-facing contact/notification form and writes those values into the headers of outgoing notification emails.

When a submitted field value is configured — by an administrator — to populate a header (for example, to set a Reply-To, From, or similar header from form data), the plugin uses the raw user-submitted string without removing carriage return (\r) and line feed (\n) characters. Because SMTP headers are line-oriented and terminated by CRLF sequences, an attacker who embeds \r\n inside a form field can terminate the intended header line and begin a new, attacker-controlled header line. The NVD description specifically names Bcc as an example of an injectable header, meaning the attacker can direct copies of the generated notification email to arbitrary recipient addresses.

Key characteristics derivable from the provided data:

• Attack vector: Network (AV:N) — the plugin's form submission endpoint is reachable over the internet.
• Privileges required: None (PR:N) — no authentication is needed to submit a form value.
• User interaction: None (UI:N) — the injection occurs server-side during email composition; no victim must click anything.
• Attack complexity: High (AC:H) — exploitation requires that a site administrator has configured a specific field's submitted value to populate an email header. This is not the default behavior of every form, so an attacker must first identify a suitable target configuration.
• Scope: Unchanged (S:U) — the impact is confined to the vulnerable component and its email-sending behavior.
• Confidentiality: Low (C:L) — a Bcc-injected message may expose the notification content to an attacker-chosen address.
• Integrity: Low (I:L) — injected headers alter the content/recipient set of the outgoing message.
• Availability: None (A:N).

The affected product family is the MetForm WordPress plugin (product name MetForm, published/developed in the WordPress ecosystem; the CVE data attributes the vendor as "Roxnor"). No function names, class names, endpoints, file paths, or parameter names are provided in the NVD description or CNA title, so per the accuracy constraints of this report, none are asserted. The vulnerability mechanism is therefore described at the class level: improper neutralization of newline characters in header-bound user input. WordPress contact-form plugins commonly accept POST data from unauthenticated visitors, so the attack surface is any publicly reachable page rendering a MetForm form whose configuration maps a submitted value into a mail header.

Because the flaw sits in header construction rather than mail transport, exploitation does not require the attacker to control the SMTP server; the vulnerable application itself transmits the maliciously modified message. This makes the vulnerability a classic "mail relay / spoofing" enabler rather than a direct code-execution issue.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (email header injection) and the NVD description. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker enumerates WordPress sites running MetForm below 4.1.9 (e.g., via passive fingerprinting of plugin assets or public vulnerability databases). The attacker then identifies forms whose submissions are reflected into email headers — this is the AC:H constraint: the attacker must find a deployment where an administrator has configured "a submitted field value to populate a header." This may be tested by submitting distinctive values and observing resulting email behavior (e.g., where a copy can be received), or inferred from form purpose (e.g., forms that set the sender/Reply-To from a submitted email field).

2. Triggering the flaw class. The attacker submits the public form with a crafted value in the header-bound field. The value contains newline characters (CRLF) followed by a new header line — for example, terminating the intended header and starting a "Bcc:" line with an attacker-controlled address. Because the plugin does not neutralize newline characters, the injected sequence is preserved into the outgoing message header block.

3. Payload / execution method. At the vulnerability-class level, the payload is a header-injection string embedded in an otherwise ordinary form submission. The exact delimiter and encoding needed (raw \r\n vs. encoded variants) cannot be specified from the available data. No code is executed on the target host; the "execution" is the mail server parsing the attacker-augmented header block and honoring the injected Bcc/other header.

4. Post-exploitation impact. Via an injected Bcc, the attacker receives copies of notification emails the site would otherwise send only to legitimate recipients — potentially disclosing form content (which may include other users' submissions in notification workflows) or enabling observation of site mail patterns. Injecting other headers can be used to spoof sender identity or manipulate routing to abuse the site's mail reputation (spam relay / deliverability damage). Because delivery is driven by the vulnerable application, the sending domain's reputation is at risk. No public evidence of in-the-wild exploitation, no known threat-actor campaign, and no exploit code were identified in the provided data.

Impact Assessment

The CVSS 3.1 base score is 4.8 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. Network reachability and zero required privileges or user interaction make the vulnerability broadly reachable, but the High attack complexity (AC:H) reflects the prerequisite that a header-populating field configuration must exist on the target. Confidentiality and Integrity impacts are both Low and there is no Availability impact, yielding a Medium overall rating.

Business impact centers on email integrity and reputation rather than data breach or system compromise:

• Spam/phishing relay abuse: injected Bcc/headers can be used to distribute unwanted mail under the site's sending identity, harming domain reputation and potentially triggering blocklisting of the site's mail server.
• Information disclosure (Low): notification content may be copied to attacker-controlled addresses.
• Spoofing: attacker-controlled header injection can falsify sender/recipient metadata.
• Blast radius: any WordPress site running an affected MetForm version where an administrator has bound a submitted value to a mail header. Sites using MetForm purely for stored/displayed submissions without header-binding are not exploitable via this specific flaw.

Public exposure of MetForm-enabled forms makes discovery trivial; no authentication is needed. However, the AC:H prerequisite and Low C/I impacts materially limit severity. Affected systems are presumed to be MetForm installations below 4.1.9; no OSV package data was provided.

Detection Guidance

Detection strategy: monitor form submission traffic for CRLF sequences in input destined for email headers, monitor outgoing mail logs for anomalous/attacker-controlled Bcc or extra headers, and inventory plugin versions.

Sigma Rule

title: MetForm WordPress Plugin Email Header Injection Attempt (CVE-2026-86813)
id: 5f3c1e7a-9b2d-4a61-8e0f-2d6b7c4a1e90
status: experimental
description: Detects HTTP requests containing CRLF sequences in form fields consistent with SMTP header injection against the MetForm WordPress plugin before 4.1.9.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86813
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  service: httpd
detection:
  selection_crlf:
    cs-uri-query|contains:
      - '%0d%0a'
      - '%0D%0A'
      - '%0a%0d'
  selection_header:
    cs-uri-query|contains:
      - 'bcc%3a'
      - 'Bcc%3a'
      - 'cc%3a'
      - 'content-type%3a'
  condition: selection_crlf or (selection_crlf and selection_header)
falsepositives:
  - Legitimate applications encoding multiline text in query strings
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-86813

YARA Rule

rule CVE_2026_86813_MetForm_HeaderInjection
{
    meta:
        author = "valtersit.com"
        description = "Detects MetForm WordPress plugin installs and CRLF header injection indicators (CVE-2026-86813)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86813"
        date = "2026-01-01"
    strings:
        $plugin = "wp-content/plugins/metform" ascii wide nocase
        $slug   = "metform" ascii wide nocase
        $crlf1  = "%0d%0a" ascii nocase
        $crlf2  = "%0D%0A" ascii nocase
        $bcc    = "Bcc:" ascii wide nocase
        $bccenc = "bcc%3a" ascii nocase
    condition:
        $plugin and (any of ($crlf*)) and (any of ($bcc*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86813 MetForm Email Header Injection (CRLF) Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"metform"; nocase; http.request_body; content:"%0d%0a"; nocase; http.request_body; content:"bcc"; nocase; reference:cve,2026-86813; classtype:web-application-attack; sid:202686813; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and http.request.body contains "%0d%0a" and
      (http.request.body contains "bcc" or http.request.body contains "Bcc") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval raw=urldecode(uri_query)
| where match(raw,"(?i)%0d%0a|%0a%0d|\\r\\n") AND match(raw,"(?i)bcc:|cc:|content-type:")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips by uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,metform,">
  <rule id="100813" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>metform</url>
    <match>%0d%0a|%0D%0A|%0a%0d|%0A%0D</match>
    <description>CVE-2026-86813: Possible MetForm email header injection attempt (CRLF in request)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_86813,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source: patch sources list is empty, vendor fix N/A, workarounds N/A).

1. Immediate mitigations

• Identify and inventory all WordPress installations running MetForm; confirm versions against the "< 4.1.9" affected range.
• Where MetForm is not essential, deactivate/remove the plugin to eliminate the attack surface.
• Review MetForm form configurations and remove any configuration in which a user-submitted field value is mapped to an email header. This directly removes the AC:H precondition (a header populated from submitted data). Where the plugin exposes such a setting, prefer static/administrator-defined header values.
• Apply input filtering at the web application firewall (WAF) level: block or strip CRLF sequences (%0d%0a, %0a%0d) in incoming form submissions to MetForm endpoints. This is a compensating control, not a fix.
• Harden mail egress: restrict outbound SMTP so the site cannot relay to arbitrary destinations and monitor for unexpected Bcc recipients.

2. Patch / upgrade steps

• The CNA/NVD description references version 4.1.9 as the fix boundary ("before 4.1.9"). Upgrade MetForm to 4.1.9 or later.
• Because patch confidence is 0/4 and no vendor fix or patch sources are available in this dataset, verify the fix directly with the plugin vendor/WordPress plugin repository before relying on it. Treat any upgrade as unverified until confirmed.
• After upgrading, re-test form submissions with CRLF-laden values to confirm neutralization.

3. Long-term hardening

• Enforce a vulnerability management process that tracks WordPress plugins and maps them to CVEs (this CVE was not in CISA KEV and had no public exploit, so it is easily missed by exploit-driven programs).
• Deploy WAF rules that generically strip CRLF from all user input destined for form/mail pipelines.
• Adopt secure coding practice for any form-to-email integration: always sanitize/strip CR/LF from any value placed into mail headers and never derive header values from unvalidated user input.
• Monitor mail server logs for anomalous header injection and reputation-impacting outbound mail.

References

• NVD — CVE-2026-86813: https://nvd.nist.gov/vuln/detail/CVE-2026-86813
• MITRE CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection'): https://cwe.mitre.org/data/definitions/93.html
• OWASP — CRLF Injection / Email Header Injection: https://owasp.org/www-community/attacks/CRLF_Injection
• FIRST EPSS — not yet scored for CVE-2026-86813 (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-86813 NOT listed (checked; no KEV entry)

Threat actor / exploit-in-the-wild evidence: none identified. No public PoC, no Nuclei template, no exploit code, and no known campaigns were present in the provided dataset.