Vulnerabilities > CVE-2019-15092 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Webtoffee Import Export Wordpress Users
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Exploit-Db
id | EDB-ID:47303 |
last seen | 2019-08-26 |
modified | 2019-08-26 |
published | 2019-08-26 |
reporter | Exploit-DB |
source | https://www.exploit-db.com/download/47303 |
title | WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection |
Packetstorm
data source | https://packetstormsecurity.com/files/download/154203/wpimportexportwpusers131-csvinject.txt |
id | PACKETSTORM:154203 |
last seen | 2019-08-26 |
published | 2019-08-23 |
reporter | Javier Olmedo |
source | https://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-Users-1.3.1-CSV-Injection.html |
title | WordPress Import Export WordPress Users 1.3.1 CSV Injection |