Description (CNA)
The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vaniivan / Simple User Import Export | affected 0 through 1.1.7 |
CWE
CWE-1236
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39ec49b4-f0f3-4ec7-b11b-ce808c025577?source=cve
- https://it.wordpress.org/plugins/a3-user-importer/
ADP enrichment
No English description supplied.
No references supplied.