Sign-up Sheets < 1.0.14 - Authenticated CSV Injection
Description
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Sign-up Sheetsdescription
- Range: <1.0.14
Patches
Vulnerability mechanics
Root cause
"Missing sanitization of the Sheet title when generating CSV export output allows injection of spreadsheet formula characters."
Attack vector
An authenticated attacker with the ability to create or edit sign-up sheets can inject a malicious payload into the Sheet title field. When an administrator or other user exports the sheet data as a CSV file, the unsanitized title is written directly into the CSV output [ref_id=1]. If the CSV is opened in a spreadsheet application such as Microsoft Excel, formulas starting with characters like `=`, `+`, `-`, or `@` are executed, potentially leading to arbitrary command execution on the victim's machine [CWE-1236].
Affected code
The advisory does not specify exact file paths or function names. The vulnerability exists in the CSV export functionality of the Sign-up Sheets plugin, where the Sheet title is used without sanitization when generating the CSV output [ref_id=1].
What the fix does
The advisory states the vulnerability is fixed in version 1.0.14 of the Sign-up Sheets plugin [ref_id=1]. No patch diff is provided in the bundle, but the fix would involve sanitizing or escaping the Sheet title before including it in the generated CSV file, preventing formula injection characters from being interpreted by spreadsheet software.
Preconditions
- authAttacker must be an authenticated user with the ability to create or edit sign-up sheets
- inputA victim must export the sheet data as a CSV file and open it in a spreadsheet application that executes formulas
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.