WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection
CVE-2022-46809

9.8CRITICAL

Key Information:

Vendor
WordPress
Status
Reviewx – Multi-criteria Rating & Reviews For WooCommerce
Vendor
CVE Published:
7 November 2023

Summary

The ReviewX plugin for WooCommerce, developed by WPDeveloper, is susceptible to a CSV Injection vulnerability. This flaw occurs due to improper handling of formula elements within CSV files, which can potentially allow attackers to execute malicious code when the affected CSV file is opened. The vulnerability affects all versions of ReviewX up to 1.6.7, emphasizing the necessity for users to update to a secure version and implement best practices for file handling to mitigate risks associated with this type of vulnerability.

Affected Version(s)

ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.7

References

https://patchstack.com/database/vulnerability/reviewx/wor...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.