{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/gutenverse/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gutenverse:form:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124018"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gutenverse Form (\u003c 3.2.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gutenverse"],"content_html":"\u003cp\u003eThe Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability. Unauthenticated attackers can submit free-text field values to the public form-submit REST route containing spreadsheet formula-trigger characters, including =, +, @, or a leading minus. The input sanitization fails to strip these characters, allowing them to be stored in the entry-data post meta. When an administrator exports these entries, the resulting CSV file may contain unneutralized formulas that execute upon opening in spreadsheet software, potentially enabling data exfiltration or command execution on the administrator's workstation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for potential data exfiltration or command execution on an administrator's workstation when the exported CSV file is processed by spreadsheet software.\u003c/p\u003e\n","date_modified":"2026-11-12T16:49:58Z","date_published":"2026-11-12T16:49:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gutenverse-csv-injection-cve-2026-124018/","summary":"The Gutenverse Form plugin for WordPress contains a CSV formula injection vulnerability that allows unauthenticated attackers to submit malicious payloads via the public form-submit REST route, which can result in command execution when an administrator opens exported form data.","title":"Gutenverse Form for WordPress: CSV formula injection (CVE-2026-124018)","url":"https://feed.craftedsignal.io/briefs/2026-11-gutenverse-csv-injection-cve-2026-124018/"}],"language":"en","title":"CraftedSignal Threat Feed - Gutenverse","version":"https://jsonfeed.org/version/1.1"}