Jegstudio Gutenverse Form Plugin up to 3.2.1 CSV Export sanitize_text_field csv injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Jegstudio Gutenverse Form Plugin up to 3.2.1. This affects the function sanitize_text_field of the component CSV Export. This manipulation causes csv injection. The identification of this vulnerability is CVE-2026-124018. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Jegstudio Gutenverse Form Plugin up to 3.2.1. Affected by this vulnerability is the function sanitize_text_field of the component CSV Export. The manipulation with an unknown input leads to a csv injection vulnerability. The CWE definition for the vulnerability is CWE-1236. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

It is possible to read the advisory at wordpress.org. This vulnerability is known as CVE-2026-124018 since 11/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.2.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-124404). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Jegstudio

Name

• Gutenverse Form Plugin

Version

• 3.2.0
• 3.2.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion