GeoDirectory <= 2.2.19 - CSV Injection
Strategic Overview
<= 2.2.19N/AVulnerability Overview
The GeoDirectory plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.2.19. This allows administrator-level attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Technical Analysis
REMEDIATION: Update to version 2.2.20, or a newer patched version --- IDENTIFIER: CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C