WordPress codepress-admin-columns injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. codepress-admin-columns is a content management plugin used in it. An injection vulnerability exists in WordPress...

CVE-2019-17661

CVE-2019-17661 affects the WordPress plugin codepress-admin-columns (Admin Columns) v3.4.6. A CSV injection vulnerability allows a user with a crafted name (containing a formula) to cause exported CSV data to execute in Excel, potentially enabling remote control of a victim’s machine. The in‑docu...

PT-2019-15242 · Microsoft +1 · Office Excel +1

Name of the Vulnerable Software and Affected Versions: codepress-admin-columns plugin version 3.4.6 Description: A CSV injection in the codepress-admin-columns plugin for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as their first or last...

CVE-2019-17661: Improper Neutralization of Formula Elements in a CSV File

A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...