{
 "id": "WPSEC-2026-2100",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2100/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2100/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2100/index.md",
 "title": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Unauthenticated Email Header Injection via Contact Name",
 "description": "The FluentCRM plugin for WordPress is vulnerable to Email Header Injection via the contact name in all versions up to, and including, 3.2.6, due to insufficient neutralization of address separators when building the 'Name <email>' To value. Names containing commas were only wrapped in quotes, but wp_mail() splits the To value on every comma. Including the name is on by default. This makes it possible for unauthenticated attackers who set a contact's name through public forms to add their own addresses as recipients of emails the site sends to that contact, such as double opt-in confirmation and subscription management emails.",
 "plugin": {
  "slug": "fluent-crm",
  "name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "full_name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "wordpress_org": "https://wordpress.org/plugins/fluent-crm/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-crm/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-crm"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-93"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.0",
 "remediation": "Update to 3.3.0 or later.",
 "fix_released": "2026-10-29T14:21:34+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-29T17:47:23.884294+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2100/",
  "https://plugins.svn.wordpress.org/fluent-crm/tags/3.3.0/",
  "https://wordpress.org/plugins/fluent-crm/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-crm",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}