WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection
CVE-2022-47442

5.8MEDIUM

Key Information:

Vendor

WordPress
Status
UsersWP
Vendor
CVE Published:
7 November 2023

What is CVE-2022-47442?

A vulnerability exists in the UsersWP plugin by AyeCode Ltd, allowing for improper neutralization of formula elements within CSV files. This flaw could enable an attacker to manipulate CSV data, leading to potential malicious code execution when the file is opened by a user. All versions from n/a through 1.2.3.9 are impacted, emphasizing the necessity for users to take security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

UsersWP <= 1.2.3.9

References

https://patchstack.com/database/vulnerability/userswp/wor...
vdb-entry

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justiice (Patchstack Alliance)
.