WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection
CVE-2023-41798

5.1MEDIUM

Key Information:

Vendor

WordPress
Status
Directorist – WordPress Business Directory Plugin With Classified Ads Listings
Vendor
CVE Published:
7 November 2023

What is CVE-2023-41798?

A vulnerability exists in the wpWax Directorist – WordPress Business Directory Plugin that allows for improper neutralization of formula elements in CSV files. This can lead to potential security risks where an attacker may exploit this issue by crafting malicious CSV files that could execute unintended commands when opened. Affected versions of the wpWax Directorist plugin are vulnerable, enabling attackers to manipulate data and potentially expose sensitive information.

Affected Version(s)

Directorist – WordPress Business Directory Plugin with Classified Ads Listings <= 7.7.1

References

https://patchstack.com/database/vulnerability/directorist...
vdb-entry

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada (Patchstack Alliance)
.