WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection
CVE-2022-47442

8.8HIGH

Key Information:

Vendor
WordPress
Status
UsersWP
Vendor
CVE Published:
7 November 2023

Summary

A vulnerability exists in the UsersWP plugin by AyeCode Ltd, allowing for improper neutralization of formula elements within CSV files. This flaw could enable an attacker to manipulate CSV data, leading to potential malicious code execution when the file is opened by a user. All versions from n/a through 1.2.3.9 are impacted, emphasizing the necessity for users to take security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

UsersWP <= 1.2.3.9

References

https://patchstack.com/database/vulnerability/userswp/wor...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justiice (Patchstack Alliance)
.