{"id":"CVE-2026-124018","kind":"vulnerability","aliases":["CVE-2026-124018"],"related":[],"title":"Gutenverse Form WordPress plugin: CSV export lets spreadsheet formulas run","description":"Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.","summary":"The Gutenverse Form plugin for WordPress stores unauthenticated form submissions without neutralizing spreadsheet formula characters, so later CSV exports carry them through. When an administrator opens an exported file, an injected formula can exfiltrate data to an attacker's URL or run commands on the administrator's workstation.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Gutenverse Form","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gutenverse-form","package","self-hosted","wordpress"],"not_affected_if":["no-csv-export","no-public-forms","plugin-at-3.2.2-or-later"],"how_to_check":"- Check the installed Gutenverse Form plugin version in the WordPress admin plugin list or the plugin's main file header.\n- Look for a public form using the Gutenverse Form submission route and whether CSV export of entries is used by administrators.","fix":"- Gutenverse Form plugin: `3.2.2` or later (per the advisory's 'before 3.2.2').","status":"open","published_at":"2026-11-12T14:17:27+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:08+00:00","updated_at":"2026-11-12T14:39:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T14:39:08Z","model":"claude-haiku-5-5","output":{"fix":"- Gutenverse Form plugin: `3.2.2` or later (per the advisory's 'before 3.2.2').","reach":"internet","title":"Gutenverse Form WordPress plugin: CSV export lets spreadsheet formulas run","impact":"high","summary":"The Gutenverse Form plugin for WordPress stores unauthenticated form submissions without neutralizing spreadsheet formula characters, so later CSV exports carry them through. When an administrator opens an exported file, an injected formula can exfiltrate data to an attacker's URL or run commands on the administrator's workstation.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gutenverse-form","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Administrator's workstation runs injected spreadsheet formula; data exfiltrated.","analyst_note":"Confirm the affected version range and fixed version against the vendor or the vulncheck advisory (www.vulncheck.com); sources list no product data.","how_to_check":"- Check the installed Gutenverse Form plugin version in the WordPress admin plugin list or the plugin's main file header.\n- Look for a public form using the Gutenverse Form submission route and whether CSV export of entries is used by administrators.","plain_action":"","product_name":"Gutenverse Form","needs_analyst":true,"not_affected_if":["plugin-at-3.2.2-or-later","no-public-forms","no-csv-export"],"who_is_affected":"Sites running the Gutenverse Form plugin before 3.2.2 that accept public form submissions and whose administrators export entries to CSV. The risk lands on the administrator who opens the exported file in a spreadsheet, so sites without public forms or without CSV exports are less exposed. Sources do not say whether non-default configuration is required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4711,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124018':13A,16A '-2026':12A,15A '3.2.2':81C 'administr':51B,72B,163C,182C 'allow':89C 'attack':64B,91C,130C,174C 'attacker-control':173C 'carri':46B 'caus':156C 'charact':41B,98C,123C 'command':69B,178C 'contain':82C 'control':175C 'csv':5A,44B,84C,153C 'cve':11A,14A 'data':61B,138C,169C 'enabl':168C 'entri':137C 'entry-data':136C 'esc':149C 'execut':160C,179C 'exfiltr':60B,170C 'export':6A,45B,54B,144C,154C,166C 'field':104C,120C 'file':55B,167C 'form':2A,18A,21B,29B,35B,76C,110C 'form-submit':109C 'formula':9A,40B,58B,85C,96C,134C,158C 'formula-trigg':95C 'fputcsv':147C 'free':102C 'free-text':101C 'function':155C 'gutenvers':1A,20B,28B,75C 'gutenverse':17A 'gutenverse-form':19B 'host':25B 'html':150C 'inject':57B,86C,93C 'input':116C 'later':43B,143C 'lead':128C 'let':7A 'malici':133C 'meta':140C 'minus':129C 'neutral':38B 'open':52B,164C 'packag':22B 'plugin':4A,30B,77C 'post':139C 'public':108C 'rest':112C 'rout':113C 'run':10A,68B 'sanit':115C,118C 'self':24B 'self-host':23B 'spreadsheet':8A,39B,94C 'store':33B,132C 'strip':122C 'submiss':36B 'submit':100C,111C 'text':103C,119C 'trigger':97C 'unauthent':34B,90C 'unneutr':145C 'url':66B,176C 'valu':105C 'via':146C 'vulner':87C 'without':37B,121C 'wordpress':3A,26B,32B,79C 'workstat':74B,184C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gutenverse Form plugin before 3.2.2 that accept public form submissions and whose administrators export entries to CSV. The risk lands on the administrator who opens the exported file in a spreadsheet, so sites without public forms or without CSV exports are less exposed. Sources do not say whether non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["form","gutenverseform"],"ptokens":["form","gutenverse"],"labels":["gutenverseform","high","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-124018':13A,16A '-2026':12A,15A 'csv':5A 'cve':11A,14A 'export':6A 'form':2A,18A 'formula':9A 'gutenvers':1A 'gutenverse':17A 'let':7A 'plugin':4A 'run':10A 'spreadsheet':8A 'wordpress':3A","search_b":"'administr':51B,72B 'attack':64B 'carri':46B 'charact':41B 'command':69B 'csv':44B 'data':61B 'exfiltr':60B 'export':45B,54B 'file':55B 'form':21B,29B,35B 'formula':40B,58B 'gutenvers':20B,28B 'gutenverse-form':19B 'host':25B 'inject':57B 'later':43B 'neutral':38B 'open':52B 'packag':22B 'plugin':30B 'run':68B 'self':24B 'self-host':23B 'spreadsheet':39B 'store':33B 'submiss':36B 'unauthent':34B 'url':66B 'without':37B 'wordpress':26B,32B 'workstat':74B","search_c":"'3.2.2':81C 'administr':163C,182C 'allow':89C 'attack':91C,130C,174C 'attacker-control':173C 'caus':156C 'charact':98C,123C 'command':178C 'contain':82C 'control':175C 'csv':84C,153C 'data':138C,169C 'enabl':168C 'entri':137C 'entry-data':136C 'esc':149C 'execut':160C,179C 'exfiltr':170C 'export':144C,154C,166C 'field':104C,120C 'file':167C 'form':76C,110C 'form-submit':109C 'formula':85C,96C,134C,158C 'formula-trigg':95C 'fputcsv':147C 'free':102C 'free-text':101C 'function':155C 'gutenvers':75C 'html':150C 'inject':86C,93C 'input':116C 'later':143C 'lead':128C 'malici':133C 'meta':140C 'minus':129C 'open':164C 'plugin':77C 'post':139C 'public':108C 'rest':112C 'rout':113C 'sanit':115C,118C 'spreadsheet':94C 'store':132C 'strip':122C 'submit':100C,111C 'text':103C,119C 'trigger':97C 'unauthent':90C 'unneutr':145C 'url':176C 'valu':105C 'via':146C 'vulner':87C 'without':121C 'wordpress':79C 'workstat':184C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124018","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124018","severity":null,"published_at":"2026-11-12T14:17:27+00:00","modified_at":"2026-11-12T14:17:27+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null}],"documents":[{"id":135520,"url":"https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}