The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress allows unauthenticated users to inject arbitrary email headers by exploiting improper CRLF neutralization in the contact form handler. The vulnerability stems from placeholder substitution that is then inserted into email headers without sanitization, enabling header injection such as Bcc or Cc. This can be used to send spam or redirect mail from the site, compromising the integrity of the website’s email system.

Affected systems are installations of the Pagelayer plugin for WordPress, developed by Softaculous, up to and including version 2.0.7. Any WordPress site that has the contact form feature enabled and uses placeholder values in email headers is susceptible.

The CVSS base score of 5.3 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the lack of authentication required and the publicly accessible contact form make exploitation straightforward. Attackers can exploit the flaw by submitting crafted form data to inject headers, thereby misusing the site’s email functionality or sending unwanted mail.