CVE-2026-91831: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in Subscribe to Comments

The Subscribe to Comments WordPress plugin versions from 2.3 up to but not including 2.3.3 do not properly sanitize newline characters in the notification sender-name setting before using it in email headers. This improper neutralization of CRLF sequences (CWE-93) enables users with Author-level privileges or higher to inject arbitrary email headers, such as hidden Bcc recipients, and spoof the sender address in notification emails.

An attacker with Author-level access or higher can manipulate email headers in notification emails sent by the plugin. This could be used to add hidden Bcc recipients or spoof the sender address, potentially facilitating phishing or spam campaigns. The confidentiality and integrity of email communications may be affected. The CVSS score is 3.8 (low severity), indicating limited impact and requiring high privileges for exploitation.

Upgrade the Subscribe to Comments plugin to version 2.3.3 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version range affected and fixed in 2.3.3.