CSV Injection Vulnerability in Admin Columns for WordPress
CVE-2019-17661

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Admin Columns
Vendor
CVE Published:
8 November 2019

Summary

A vulnerability has been identified in the Admin Columns plugin for WordPress, specifically in version 3.4.6, which allows attackers to perform CSV injection. By using formula code as their name, an attacker can create a user profile that includes malicious scripts. When other users download and open these CSV files, particularly in applications like Microsoft Excel, they may inadvertently execute the embedded code, potentially allowing attackers to gain unauthorized remote control over the users' devices.

References

https://www2.deloitte.com/de/de/pages/risk/articles/wordp...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.