CVE-2026-2442 is a CWE-93 Improper Neutralization of CRLF Sequences vulnerability in the Page Builder: Pagelayer WordPress plugin. The issue arises from the contact form handler performing placeholder substitution on user-supplied input and then passing these values into email headers without sanitizing CR/LF characters. This allows unauthenticated attackers to inject arbitrary email headers, potentially abusing the email delivery mechanism of the contact form. The vulnerability affects all versions up to and including 2.0.7. No known exploits are reported in the wild, and no patch or remediation details are currently available.

The vulnerability allows unauthenticated attackers to inject arbitrary email headers via the contact form's 'email' parameter, potentially enabling abuse of the email delivery system such as adding Bcc or Cc recipients. This can lead to misuse of the contact form for spam or phishing campaigns. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling contact forms that use placeholder substitution in mail template headers or restrict access to such forms. Monitoring vendor channels for updates is recommended.