Vulnerability · Published Apr 12, 2022 · Assigned by WPScan
CVE-2022-0142Visual Form Builder < 3.0.6 - CSV Injection
Critical 9.8
In plain English
A critical-severity security flaw in Visual Form Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.9%top 13.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Visual Form Builder | 3.0.8 – before 3.0.8 |
Weakness: CWE-1236
References
- https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878 x_refsource_MISC
- https://www.fortiguard.com/zeroday/FG-VD-21-080 x_refsource_MISC