CSV Formula Injection Vulnerability in Gutenverse Form Plugin for WordPress

CVE-2026-124018

What is CVE-2026-124018?

The Gutenverse Form plugin for WordPress prior to version 3.2.2 is susceptible to a CSV formula injection vulnerability. This issue allows unauthenticated attackers to submit malicious data via public form fields. The input sanitization method used in the plugin inadequately filters certain characters, including '=', '+', '@', and leading minus signs, thereby facilitating the injection of harmful spreadsheet formulas into the entry-data post meta. When administrators later export this data, they unknowingly trigger the execution of these malicious formulas. As a result, sensitive data can be exfiltrated to attacker-controlled URLs or lead to command execution on the administrator's workstation upon opening the exported CSV file.

References