CVE-2026-12127 is a CRLF injection vulnerability in the WPForms – AI Form Builder for WordPress plugin affecting all versions up to 1.10.2. The issue stems from the get_reply_to_address() function using the 'notification' context instead of 'notification-reply-to' during smart-tag expansion, which bypasses email address validation. Additionally, the wpforms_sanitize_textarea_field() function preserves CR/LF characters that are not stripped before concatenating the Reply-To display name into the raw Reply-To mail header. This allows unauthenticated attackers to inject arbitrary additional email headers, such as Bcc, into outgoing notification emails. Exploitation requires that a form notification is configured to use a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.

An unauthenticated attacker can inject additional email headers into outgoing notification emails, enabling silent blind-copying (Bcc) of all notification emails to an attacker-controlled address. This compromises confidentiality of notification emails but does not affect email availability or integrity. There is no direct impact on system availability or data confidentiality beyond email exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring form notifications to use a Paragraph Text (textarea) field as the Reply-To display name via Smart Tags. Monitor vendor channels for updates and apply official patches once released.