CVE-2022-3634

Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

CVSS 9.8 CRITICALEPSS 3.6%

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 3.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

21 Nov 2022Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unknown · Contact Form 7 Database Addon

public PoCs found — 1

cve_referencewpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10