CERT24GHSA-ghmm-gqr3-xwc7Loading data…
CERT24Threat Observatory
Period

GHSA-ghmm-gqr3-xwc7

Versions before 1.11.1 of the Contact Form by Supsystic WordPress plugin did not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers. When a field was configured for the Reply-To, From, or Cc header, unauthenticated users could inject arbitrary email headers, such as additional Bcc or Cc recipients, into the notification email.

← Back to intelligence

GHSA-ghmm-gqr3-xwc7

Versions before 1.11.1 of the Contact Form by Supsystic WordPress plugin did not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers. When a field was configured for the Reply-To, From, or Cc header, unauthenticated users could inject arbitrary email headers, such as additional Bcc or Cc recipients, into the notification email.