PT-2020-15446 · WordPress · Easy Registration Forms (Er Forms) Wordpress Plugin

Published 2020-11-04 · Updated 2021-07-21 · CVE-2020-22275

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Registration Forms (ER Forms) Wordpress Plugin version 2.0.6

Description The issue allows an attacker to submit an entry with malicious CSV commands. When the system administrator generates CSV output from the forms information, there is no check on these inputs, and the codes are executable. This can lead to the execution of malicious commands.

Recommendations For Easy Registration Forms (ER Forms) Wordpress Plugin version 2.0.6, consider disabling the CSV output generation feature until a patch is available to prevent the execution of malicious commands. Restrict access to the forms information to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-22275

Affected Products

Easy Registration Forms (Er Forms) Wordpress Plugin

References · 7

• 🔥 https://filebin.net/30ceikgukh268yyj · Exploit
• 🔥 https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22275.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-22275 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22275 · Vendor Advisory
• https://t.me/cvenotify/5118 · Telegram Post
• http://uploadboy.com/ty0715vdcii6/886/mp4 · Note
• https://t.me/cibsecurity/15838 · Telegram Post