---
id: "CVE-2026-124018"
page: "https://infrastack.ai/live/CVE-2026-124018"
kind: "vulnerability"
aliases: ["CVE-2026-124018"]
title: "Gutenverse Form WordPress plugin: CSV export lets spreadsheet formulas run"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Gutenverse Form", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["gutenverse-form", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-csv-export", "no-public-forms", "plugin-at-3.2.2-or-later"]
published_at: "2026-11-12T14:17:27+00:00"
first_seen_at: "2026-11-12T14:38:37+00:00"
updated_at: "2026-11-12T14:39:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124018", "first_seen_at": "2026-11-12T14:38:37+00:00"}]
exploit_sources: []
---

# Gutenverse Form WordPress plugin: CSV export lets spreadsheet formulas run

Link for people: https://infrastack.ai/live/CVE-2026-124018 (this .md is for agents)

The Gutenverse Form plugin for WordPress stores unauthenticated form submissions without neutralizing spreadsheet formula characters, so later CSV exports carry them through. When an administrator opens an exported file, an injected formula can exfiltrate data to an attacker's URL or run commands on the administrator's workstation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Gutenverse Form affected range not listed fixed no fixed version listed

## How to check

- Check the installed Gutenverse Form plugin version in the WordPress admin plugin list or the plugin's main file header.
- Look for a public form using the Gutenverse Form submission route and whether CSV export of entries is used by administrators.

## Fix

- Gutenverse Form plugin: `3.2.2` or later (per the advisory's 'before 3.2.2').

## Timeline

- 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124018

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission

## From the sources

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_