CyberRota Analysis
AI-GeneratedThe JetFormBuilder WordPress plugin prior to version 3.6.5.2 is vulnerable due to inadequate validation of line breaks in address values from submitted forms, enabling unauthenticated users to inject arbitrary email headers. This flaw can lead to email header manipulation, allowing attackers to add hidden recipients and spoof sender addresses. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential abuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.