WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection
CVE-2022-45348

8.8HIGH

Key Information:

Vendor
WordPress
Status
Amr Users
Vendor
CVE Published:
7 November 2023

Summary

A vulnerability exists in the amr users product developed by anmari, where improper neutralization of formula elements in CSV files can lead to CSV injection attacks. This issue affects versions from n/a through 4.59.4, allowing attackers to execute arbitrary commands by crafting malicious CSV contents. It is crucial for users to apply security measures and updates to mitigate potential exploitation risks.

Affected Version(s)

amr users <= 4.59.4

References

https://patchstack.com/database/vulnerability/amr-users/w...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.