{"id":"CVE-2026-124018","aliases":[],"cve":{"records":[{"id":"CVE-2026-124018","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T18:38:38.544Z","published":"2026-11-12T13:35:12.175Z","modified":"2026-11-12T17:17:47.526Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-12T13:35:12.175Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T17:17:47.526Z"}],"references":[{"url":"https://wordpress.org/plugins/gutenverse-form/#developers","tags":["release-notes","patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1236","description":"Improper Neutralization of Formula Elements in a CSV File","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:38:20.354317Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.","score":7.1,"severity":"high","published":"2026-11-12T13:35:12.175Z","modified":"2026-11-12T17:17:47.526Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Jegstudio","name":"Gutenverse Form – Contact Form Builder, Block Form & Booking Form","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.2.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-124018"}],"remediation":[],"references":["https://wordpress.org/plugins/gutenverse-form/#developers","https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission"],"sources":[{"name":"CVE","id":"CVE-2026-124018","modified":"2026-11-12T17:17:47.526Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-124018"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","score":5.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-12T19:01:32.756Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T21:50:39.934Z","attemptedAt":"2026-11-12T21:50:39.934Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T21:50:38.707Z","attemptedAt":"2026-11-12T21:50:38.707Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T21:50:38.682Z","attemptedAt":"2026-11-12T21:50:38.682Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T21:50:38.630Z","attemptedAt":"2026-11-12T21:50:38.630Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124404","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124404","modified":"Nov 12, 2026, 5:17:47 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","checkedAt":"2026-11-12T21:50:38.682Z"},{"source":"GitHub Advisory Database","id":"GHSA-2q49-62r7-4h3r","url":"https://github.com/advisories/GHSA-2q49-62r7-4h3r","modified":"2026-11-12T15:32:01Z","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","checkedAt":"2026-11-12T21:50:38.707Z"},{"source":"NVD","id":"CVE-2026-124018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124018","modified":"2026-11-12T21:36:06.743","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-12T21:50:39.934Z"},{"source":"NVD","id":"CVE-2026-124018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124018","modified":"2026-11-12T21:36:06.743","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","checkedAt":"2026-11-12T21:50:39.934Z"}],"aiSummary":{"text":"Gutenverse Form WordPress plugin versions before 3.2.2 have a CSV formula injection vulnerability, allowing unauthenticated attackers to inject malicious formulas via form submissions. These formulas can execute when an administrator opens the exported CSV file. The impact includes potential data exfiltration or command execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T19:26:05.133Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-124018"}]}}