CVE-2026-2442: 
WordPress vulnerability analysis and mitigation

CVE-2026-2442 is a CRLF Injection vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress, affecting all versions up to and including 2.0.7. The flaw allows unauthenticated attackers to inject arbitrary email headers (e.g., Bcc, Cc) by exploiting unsanitized placeholder substitution in the plugin's contact form handler. It was published on March 28, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'). The plugin's contact form handler performs placeholder substitution on attacker-controlled form fields (such as the email parameter) and passes the resulting values directly into email headers without stripping carriage return (\r) or line feed (\n) characters. An unauthenticated attacker who can submit a contact form configured to use placeholders in mail template headers can inject additional headers, enabling email header manipulation such as adding arbitrary Bcc or Cc recipients (Wordfence, Red Hat CVE). The precondition is that the targeted site must have a contact form configured to use placeholders in email header fields.

Successful exploitation allows attackers to abuse the site's email delivery infrastructure to send spam or phishing emails to arbitrary recipients by injecting Bcc/Cc headers, effectively turning the vulnerable WordPress site into an open email relay. The integrity impact is low and scoped to email delivery; there is no direct confidentiality or availability impact. This can result in reputational damage to the site owner, potential email domain blacklisting, and misuse of server resources (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-2442. The vulnerability is exploitable by unauthenticated attackers with no user interaction required, lowering the barrier to abuse. The EPSS score is approximately 0.077%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Pagelayer plugin (versions ≤ 2.0.7) with a publicly accessible contact form that uses placeholders (e.g., {email}) in email header fields such as From, Reply-To, or Subject.
2. Craft malicious payload: Prepare a form submission where the email field contains a CRLF sequence followed by an injected header, for example: attacker@example.com\r\nBcc: victim@spam.com.
3. Submit the form: Send an HTTP POST request to the contact form endpoint with the crafted email parameter value.
4. Header injection occurs: The plugin substitutes the attacker-controlled value into the email header without sanitization, causing the mail function to interpret the injected \r\n as a header delimiter and add the attacker-specified Bcc or Cc header.
5. Abuse email delivery: The outgoing email is delivered to both the intended recipient and the injected addresses, enabling spam distribution or phishing campaigns via the victim site's mail server (Wordfence).

• Logs: WordPress or web server access logs showing repeated POST requests to contact form endpoints with URL-encoded %0d%0a, %0a, or %0d sequences in the email parameter.
• Email Server: Outbound emails with unexpected Bcc or Cc headers originating from the WordPress site's mail function; unusual spikes in outbound email volume from the server.
• Application Logs: PHP mail logs or SMTP relay logs showing emails addressed to recipients not configured in the contact form settings.
• Network: Unusual outbound SMTP traffic volume from the web server to external mail relays.

The vulnerability is patched in Pagelayer version 2.0.8 and later, which sanitizes CR/LF characters from attacker-controlled form fields before they are used in email headers. Site administrators should update the Pagelayer plugin to version 2.0.8 or higher immediately via the WordPress plugin dashboard. As a temporary workaround, disabling contact forms that use placeholders in email header fields (e.g., From, Reply-To) can reduce exposure until the patch is applied (Wordfence, Pagelayer Changelog).

Wordfence included CVE-2026-2442 in its weekly WordPress vulnerability report for the week of March 23–29, 2026, and Sucuri referenced it in its March 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community reaction has been limited given the medium severity and low exploitation probability, with no notable threat actor attribution or significant social media discussion observed.