Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection
Strategic Overview
Vulnerability Overview
The Events Manager Pro, versions up to 2.6.7.2, and Events Manager, versions up to 5.9.7.2, plugins for WordPress are vulnerable to CSV Injection. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Technical Analysis
REMEDIATION: Update to version 2.6.7.2, or a newer patched version --- IDENTIFIER: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C