WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection

CVE-2022-41616

What is CVE-2022-41616?

A CSV injection vulnerability exists in the Export Users Data CSV plugin developed by Kaushik Kalathiya. This vulnerability can be exploited when users import crafted CSV files that contain malicious formula elements. The attack can lead to unintended command execution within the application's environment when the CSV files are processed. Users of the affected versions, ranging from n/a to 2.1, should apply necessary security updates to mitigate potential risks.

References