Vulnerability · Published Nov 28, 2022 · Assigned by WPScan
CVE-2022-3603Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection
Critical 9.8
In plain English
A critical-severity security flaw in Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.2%top 31.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list | 0 – before 2.0.69 |
References
- https://wpscan.com/vulnerability/376e2bc7-2eb9-4e0a-809c-1582940ebdc7 exploit, technical-description