Page Builder: Pagelayer CRLF Injection Vulnerability Allowing Unauthenticated Email Header Injection

A CRLF injection vulnerability has been identified in the Page Builder: Pagelayer WordPress plugin, affecting all versions through 2.0.7. The issue arises because the contact form handler substitutes placeholders in user-controlled form fields and then transfers the modified values into email headers without stripping CR/LF characters. This flaw enables unauthenticated attackers to inject arbitrary email headers, such as Bcc or Cc, and manipulate email delivery through the 'email' parameter, provided they target a contact form that uses placeholders in the mail template headers.

Impact

Exploitation of this vulnerability allows for unauthorized injection of email headers, which could be misused to manipulate email delivery processes, such as adding unintended recipients via Bcc or Cc headers.

Remediation

Users are advised to update the Page Builder: Pagelayer plugin to version 2.0.8 or a later patched version.