CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Explanation of Vulnerability in Simple Terms
WS Form LITE versions up to 1.9.217 contain a vulnerability allowing attackers to read or modify limited data through a cross-site request forgery (CSRF) attack. The attacker must trick a site administrator into visiting a malicious page while logged in. The vulnerability affects the form builder's scope, potentially impacting other site components. Update to a version newer than 1.9.217.
What an attacker can do
Read or modify limited site data by tricking an admin into visiting a malicious page.
Potential impact on your site
Attackers can alter form settings or read form submission data if an admin visits a malicious link.
Conditions required to exploit
Admin must be logged in and visit attacker-controlled page; network access only.
Key dates
External resources
Related vulnerabilities
