WPForms Pro < 1.7.7 - CSV Injection
CVE-2022-3574

9.8CRITICAL

Key Information:

What is CVE-2022-3574?

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.

WPForms Pro 1.7.7

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Francesco Carlucci