The on‑line form of the Subscribe to Comments WordPress plugin fails to remove newline characters from the sender‑name field before it is inserted into e‑mail message headers. A user who has Author level permissions or higher can modify the plugin’s settings, thereby injecting arbitrary mail headers such as additional Bcc recipients or altered “From” addresses. This flaw can lead to covert mass mailing or e‑mail spoofing, potentially enabling phishing or spam campaigns from the compromised site. The weakness is an instance of improper input validation that allows injection into protocol headers.

WordPress sites that use the Subscribe to Comments plugin version 2.3.2 or earlier are affected. The vulnerability exists in all WordPress installations where the plugin is active and a user with Author or higher privileges can change the email sender‑name setting; specific WordPress core versions are not a factor.

The CVSS score of 3.8 indicates low impact and limited impact if only the attacked site’s outbound mail is considered. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is local to the web application: an authenticated user with sufficient role can trigger the injection by editing the plugin configuration. While the flaw does not enable remote code execution, it permits stealthy email manipulation that can undermine application authenticity and potentially deliver malicious content to recipients. The overall risk is moderate in environments where authors are trusted and the site’s mail is exposed to external recipients.