CVE-2026-124018
Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
| CWE | CWE-1236 |
| Vendor | jegstudio |
| Product | gutenverse form – contact form builder, block form & booking form |
| Published | Nov 12, 2026 |
Get instant alerts for jegstudio gutenverse form – contact form builder, block form & booking form
Be the first to know when new high vulnerabilities affecting jegstudio gutenverse form – contact form builder, block form & booking form are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L