WordPress Plugin Vulnerabilities
FluentForm < 4.3.13 - CSV Injection
Description
The plugin does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
Proof of Concept
- As unauthenticated, submit a form using =5+5 as value in any field - As admin, export the data as CSV (/wp-admin/admin.php?page=fluent_forms&form_id=1&route=entries) - open the CSV with a spreadsheet application (Excel, Libre Office) - the CSV formula gets executed
Affects Plugins
Fixed in version 4.3.13
References
Classification
Miscellaneous
Original Researcher
Francesco Carlucci
Submitter
Francesco Carlucci
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-10-17 (about 7 months ago)
Added
2022-10-17 (about 7 months ago)
Last Updated
2022-10-17 (about 7 months ago)