The MetForm WordPress plugin before version 4.1.9 does not properly sanitize newline characters in user input fields that populate email headers for notification emails. This improper neutralization of CRLF sequences (CWE-93) enables unauthenticated attackers to inject arbitrary email headers, potentially modifying email recipients or content headers. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker can inject additional email headers into notification emails sent by the vulnerable MetForm plugin. This could be used to add Bcc recipients or alter email headers, potentially facilitating email spoofing or information disclosure. However, the impact is limited to confidentiality and integrity with no availability impact. No known exploits are reported in the wild.

Upgrade MetForm to version 4.1.9 or later, where this vulnerability is fixed. Since the vulnerability is patched in 4.1.9, applying this official fix fully mitigates the issue. No other specific mitigations are indicated.