Gutenverse Form for WordPress: CSV formula injection (CVE-2026-124018)
The Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability that allows unauthenticated attackers to submit malicious payloads via the public form-submit REST route, which can result in command execution when an administrator opens exported form data.
CVE search metadata
CVE search record: CVE-2026-124018. Severity: high. CVSS: 7.1. KEV: no. Product: Gutenverse Form (< 3.2.2). Brief: Gutenverse Form for WordPress: CSV formula injection (CVE-2026-124018). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gutenverse-csv-injection-cve-2026-124018/
Triage facts
Revision 1- Applicability
- Gutenverse Form (< 3.2.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability. Unauthenticated attackers can submit free-text field values to the public form-submit REST route containing spreadsheet formula-trigger characters, including =, +, @, or a leading minus. The input sanitization fails to strip these characters, allowing them to be stored in the entry-data post meta. When an administrator exports these entries, the resulting CSV file may contain unneutralized formulas that execute upon opening in spreadsheet software, potentially enabling data exfiltration or command execution on the administrator's workstation.
Impact
Successful exploitation allows for potential data exfiltration or command execution on an administrator's workstation when the exported CSV file is processed by spreadsheet software.