PT-2022-22254 · WordPress · Contact-Form-Plugin

Francesco Carlucci · Published 2022-11-07 · Updated 2022-11-09 · CVE-2022-3463

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contact Form Plugin WordPress plugin versions prior to 4.3.13

Description The issue is related to the Contact Form Plugin WordPress plugin, where it does not validate and escape fields when exporting form entries as CSV. This leads to a CSV injection.

Recommendations For versions prior to 4.3.13, update to version 4.3.13 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-3463

Affected Products

Contact-Form-Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/e2a59481-db45-4b8e-b17a-447303469364 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3463 · Security Note
• https://t.me/cibsecurity/52586 · Telegram Post
• https://t.me/cvenotify/37411 · Telegram Post