WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection
CVE-2022-46809

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Reviewx – Multi-criteria Rating & Reviews For WooCommerce
Vendor
CVE Published:
7 November 2023

What is CVE-2022-46809?

The ReviewX plugin for WooCommerce, developed by WPDeveloper, is susceptible to a CSV Injection vulnerability. This flaw occurs due to improper handling of formula elements within CSV files, which can potentially allow attackers to execute malicious code when the affected CSV file is opened. The vulnerability affects all versions of ReviewX up to 1.6.7, emphasizing the necessity for users to update to a secure version and implement best practices for file handling to mitigate risks associated with this type of vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.7

References

https://patchstack.com/database/vulnerability/reviewx/wor...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
JSON
.