CVE-2026-124018Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission
Description
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Jegstudio | Gutenverse Form – Contact Form Builder, Block Form & Booking Form | < 3.2.2 |
References and patches
- WordPress Changelog release-notespatch
- VulnCheck Advisory: Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission third-party-advisory