CVE-2026-91831: CVE-2026-91831: güvenlik açığı

Açıklama (NVD)

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

Özet bilgiler

CVSS v3.1

3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

%0,16 (yüzdelik 5)

CWE

CWE-93

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• wpscan.com
• CWE-93