WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection
CVE-2022-46809
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2023
What is CVE-2022-46809?
The ReviewX plugin for WooCommerce, developed by WPDeveloper, is susceptible to a CSV Injection vulnerability. This flaw occurs due to improper handling of formula elements within CSV files, which can potentially allow attackers to execute malicious code when the affected CSV file is opened. The vulnerability affects all versions of ReviewX up to 1.6.7, emphasizing the necessity for users to update to a secure version and implement best practices for file handling to mitigate risks associated with this type of vulnerability.
Affected Version(s)
ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.7