WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection
CVE-2022-46802

9.8CRITICAL

Key Information:

Vendor
WordPress
Status
Product Reviews Import Export For WooCommerce
Vendor
CVE Published:
7 November 2023

Summary

A CSV injection vulnerability exists in the WebToffee Product Reviews Import Export for WooCommerce plugin, allowing unauthenticated users to exploit improper neutralization of formula elements in CSV files. This flaw affects versions from n/a through 1.4.8, potentially leading to arbitrary code execution or data leakage when CSV files are manipulated.

Affected Version(s)

Product Reviews Import Export for WooCommerce <= 1.4.8

References

https://patchstack.com/database/vulnerability/product-rev...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.