Contact Form Entries < 1.3.0 - CSV Injection

2022-10-2100:00:00

Francesco Carlucci

contact form 7

ninja forms

elementor forms

wp forms

csv injection

spreadsheet application

exploit

0.001 Low

EPSS

Percentile

21.7%

JSON

The plugin does not validate data when its output in a CSV file, which could lead to CSV injection.

- Submit a form (using Contact Form 7, Ninja Forms, Elementor Forms or WP Forms) using =5+5 as the value
- Export the data as CSV (/wp-admin/admin.php?page=vxcf_leads)
- Open the CSV with a spreadsheet application (Excel, Libre Office)
- The CSV formula gets executed

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for WPEX-ID:300EBFCD-C500-464E-B919-ACFEB72593DE