PT-2026-28338 · WordPress · Pagelayer

Drew Webber · Publicado 2026-03-28 · Atualizado 2026-06-13 · CVE-2026-2442

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Page Builder: Pagelayer versions up to and including 2.0.7

Description The Page Builder: Pagelayer WordPress plugin is susceptible to CRLF Injection due to improper handling of Carriage Return and Line Feed characters in the contact form handler. The plugin performs placeholder substitution on attacker-controlled form fields and passes the resulting values into email headers without removing CR/LF characters. This allows unauthenticated attackers to inject arbitrary email headers, such as Bcc or Cc, and potentially abuse form email delivery through the email parameter, provided they can target a contact form configured to use placeholders in mail template headers.

Recommendations Update Page Builder: Pagelayer to a version later than 2.0.7

Correção

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

CVE-2026-2442

Produtos afetados

Pagelayer

Referências · 6

• https://t.me/CVEtracker/56792 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2442 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/ce101aad-10a3-4a8c-9f4a-0e38e35b4dab?source=cve · Nota
• https://twitter.com/CVEarity/status/2037937638980919307 · Publicação no Twitter
• https://t.me/cveNotify/167354 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3464204/pagelayer · Nota