VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 7, 2022· Updated May 1, 2025

FluentForm < 4.3.13 - CSV Injection

CVE-2022-3463

Description

The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Missing validation and escaping of form entry fields when exporting to CSV allows an attacker to inject spreadsheet formulas."

Attack vector

An attacker who can submit form entries (e.g., a site visitor or authenticated user) can include payloads starting with characters like `=`, `+`, `-`, or `@` in form fields. When the administrator exports those entries as a CSV file via the FluentForm plugin [ref_id=1], the payload is written unescaped into the CSV. If the CSV is opened in a spreadsheet application (e.g., Microsoft Excel or LibreOffice Calc), the formula executes, potentially exfiltrating data or executing arbitrary commands [CWE-1236].

Affected code

The advisory does not specify the exact file or function path. The vulnerability exists in the CSV export functionality of the FluentForm plugin (plugin slug: fluentform) in versions before 4.3.13 [ref_id=1].

What the fix does

The advisory states the plugin was fixed in version 4.3.13 [ref_id=1]. The fix adds validation and escaping of form entry fields before writing them into the exported CSV file, preventing spreadsheet formulas from being interpreted as code. No patch diff is included in the bundle, but the remediation guidance is to update to version 4.3.13 or later [ref_id=1].

Preconditions

  • inputThe attacker must be able to submit form entries (e.g., as a site visitor or authenticated user)
  • configAn administrator must export the form entries as a CSV file
  • configThe exported CSV must be opened in a spreadsheet application that interprets formulas

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.