CSV Injection Vulnerability in AnWP Football Leagues Plugin for WordPress

CVE-2025-8767

What is CVE-2025-8767?

The AnWP Football Leagues plugin for WordPress is susceptible to a CSV injection vulnerability that affects all versions up to 0.16.17. This flaw is found in the 'download_csv_players' and 'download_csv_games' functions, allowing authenticated users with Administrator privileges and above to inject untrusted data into CSV exports. If these files are downloaded and opened on a system with insecure settings, it can lead to arbitrary code execution, posing a significant risk to the affected environments.

References