Skip to main content

Visual Form Builder CVE-2022-0142

CRITICAL
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2022-04-12 contact@wpscan.com
RCE WordPress Visual Form Builder
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 12, 2022 - 12:15 nvd
CRITICAL 9.8

DescriptionNVD

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.

AnalysisAI

The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1236. The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution. Affected products include: Vfbpro Visual Form Builder. Version information: before 3.0.8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Visual Form Builder

View all
CVE-2022-0140 MEDIUM POC
5.3 Apr 12

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing una
CVE-2022-1046 MEDIUM POC
4.8 May 02

The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which c
CVE-2021-24514 MEDIUM POC
4.8 Oct 25

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege
CVE-2022-0141 HIGH
8.1 Apr 12

The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-0142 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy