WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection
CVE-2023-41798

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Vendor
CVE Published:
7 November 2023

Summary

A vulnerability exists in the wpWax Directorist – WordPress Business Directory Plugin that allows for improper neutralization of formula elements in CSV files. This can lead to potential security risks where an attacker may exploit this issue by crafting malicious CSV files that could execute unintended commands when opened. Affected versions of the wpWax Directorist plugin are vulnerable, enabling attackers to manipulate data and potentially expose sensitive information.

Affected Version(s)

Directorist – WordPress Business Directory Plugin with Classified Ads Listings <= 7.7.1

References

https://patchstack.com/database/vulnerability/directorist...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada (Patchstack Alliance)
.