Gutenverse Form (< 3.2.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gutenverse-form--3.2.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 16:49:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGutenverse Form for WordPress: CSV formula injection (CVE-2026-124018)https://feed.craftedsignal.io/briefs/2026-11-gutenverse-csv-injection-cve-2026-124018/Thu, 12 Nov 2026 16:49:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gutenverse-csv-injection-cve-2026-124018/The Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability that allows unauthenticated attackers to submit malicious payloads via the public form-submit REST route, which can result in command execution when an administrator opens exported form data.The Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability. Unauthenticated attackers can submit free-text field values to the public form-submit REST route containing spreadsheet formula-trigger characters, including =, +, @, or a leading minus. The input sanitization fails to strip these characters, allowing them to be stored in the entry-data post meta. When an administrator exports these entries, the resulting CSV file may contain unneutralized formulas that execute upon opening in spreadsheet software, potentially enabling data exfiltration or command execution on the administrator's workstation.

Impact

Successful exploitation allows for potential data exfiltration or command execution on an administrator's workstation when the exported CSV file is processed by spreadsheet software.

]]>highadvisory