CVE-2026-19862: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in JetFormBuilder

The JetFormBuilder WordPress plugin prior to version 3.6.5.2 does not properly validate or remove CRLF sequences from address values sourced from submitted form fields before including them in email headers. This improper neutralization of CRLF sequences (CWE-93) allows unauthenticated attackers to inject arbitrary email headers, potentially adding hidden recipients or spoofing the sender address. Exploitation depends on the site configuration using form field addresses in outgoing emails.

An attacker can inject arbitrary email headers into messages sent by the vulnerable plugin, which may lead to unauthorized addition of hidden recipients and sender spoofing. This can facilitate phishing or spam campaigns and undermine email trustworthiness. The vulnerability does not directly impact confidentiality or availability but affects email integrity and authenticity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor JetFormBuilder vendor communications for updates. Until a fix is available, avoid configuring the plugin to use form field addresses in email headers or implement input validation to strip or encode CRLF characters in form inputs used in email headers.