GUTENVERSE FORM · CVE-2026-124018 · Package
NO FIX YET · SEE WHAT TO DO
The Gutenverse Form plugin for WordPress stores unauthenticated form submissions without neutralizing spreadsheet formula characters, so later CSV exports carry them through. When an administrator opens an exported file, an injected formula can exfiltrate data to an attacker's URL or run commands on the administrator's workstation.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Gutenverse Form plugin before 3.2.2 that accept public form submissions and whose administrators export entries to CSV. The risk lands on the administrator who opens the exported file in a spreadsheet, so sites without public forms or without CSV exports are less exposed. Sources do not say whether non-default configuration is required.
Not affected if no-csv-export, no-public-forms, plugin-at-3.2.2-or-later
Who cares gutenverse-form, self-hosted, wordpress
3.2.2 or later (per the advisory's 'before 3.2.2').Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.