CVE-2026-124018: Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitizetextfield() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or eschtml() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gutenverse Form WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using a version before 3.2.2 are exposed where the plugin accepts submissions through its public form-submit REST route and includes free-text fields. The attacker does not need an account to submit the crafted values.
What must happen for the payload to have an effect?
A malicious value is stored in the form entry data and must later be exported to CSV without neutralization. The formula executes when an administrator opens the exported CSV in a spreadsheet application.
What could an attacker achieve through this issue?
The exported formula can be used to exfiltrate data to an attacker-controlled URL or execute commands on the administrator's workstation. The vulnerability does not describe direct impact to the WordPress server's confidentiality, integrity, or availability.