PT-2022-22957 · WordPress · Wpforms Pro

Francesco Carlucci · Published 2022-11-14 · Updated 2025-04-30 · CVE-2022-3574

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPForms Pro version 1.7.6 and earlier

Description The issue arises from the lack of validation of form data when generating exported CSV files, potentially leading to CSV injection.

Recommendations For WPForms Pro versions prior to 1.7.7, update to version 1.7.7 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-3574

Affected Products

Wpforms Pro

References · 4

• 🔥 https://wpscan.com/vulnerability/0eae5189-81af-4344-9e96-dd1f4e223d41 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3574 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3574 · Vendor Advisory
• https://t.me/cvenotify/120339 · Telegram Post