The WPForms plugin for WordPress, up to and including version 1.10.2, suffers from a CRLF injection vulnerability (CWE-93) in the get_reply_to_address() function. The issue arises because the Reply-To display name is processed with the 'notification' context instead of 'notification-reply-to', bypassing email address validation. Additionally, the sanitization function wpforms_sanitize_textarea_field() preserves CR/LF characters, which are concatenated directly into the raw Reply-To mail header. This allows unauthenticated attackers to inject arbitrary email headers such as Bcc into notification emails, enabling silent blind-copying of notifications to attacker-controlled addresses. Exploitation requires that the form notification uses a Paragraph Text (textarea) field as the Reply-To display name via a Smart Tag.

An unauthenticated attacker can inject additional email headers into outgoing notification emails, such as Bcc, allowing them to silently receive copies of these emails. This compromises the confidentiality of notification emails but does not affect their availability or integrity. There is no indication of direct code execution or system compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring form notifications to use a Paragraph Text (textarea) field as the Reply-To display name via Smart Tags. Monitor vendor communications for updates and apply official patches once released.