WordPress Plugin Vulnerabilities

Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection

Description

The plugin does not properly escape data when exporting it via CSV files.

Proof of Concept

1) Edit your subscriber account's nickname to: ;=1+3
2) As an administrator, export your users data via http://vulnerable-site.tld/wp-admin/tools.php?page=acui&tab=export, and open the resulting CSV file in Excel or equivalent software.

Affects Plugins

import-users-from-csv-with-meta

Fixed in version 1.20.5

References

CVE

CVE-2022-3558

URL

https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta

Classification

Type

CSV INJECTION

OWASP top 10

A1: Injection

CWE

CWE-1236

Miscellaneous

Original Researcher

Adel Bouaricha

Submitter

Adel Bouaricha

Submitter website

https://brainshell.net

Verified

Yes

WPVDB ID

e3d72e04-9cdf-4b7d-953e-876e26abdfc6

Timeline

Publicly Published

2022-10-17 (about 3 months ago)

Added

2022-10-17 (about 3 months ago)

Last Updated

2022-10-17 (about 3 months ago)

Our Other Services

WPScan WordPress Security Plugin