CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Explanation of Vulnerability in Simple Terms
Contest Gallery versions up to 27.0.3 contain an input validation flaw that allows attackers to inject malicious content into the application. An attacker must trick a user into visiting a crafted link or page to trigger the vulnerability. The flaw can result in data modification or injection attacks, though it does not compromise confidentiality or availability.
What an attacker can do
Inject malicious content or modify data by tricking a user into visiting a crafted link.
Potential impact on your site
Users' data could be modified or corrupted if they click attacker-controlled links while logged in.
Conditions required to exploit
User interaction required; attacker must trick a victim into clicking a malicious link or visiting a page.
Key dates
External resources
