What is the CVSS score of CVE-2026-19501?

CVE-2026-19501 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SureForms are affected by CVE-2026-19501?

Brainstorm Force SureForms (versions ≤2.1.1) allows attackers to inject malicious commands into form field names that execute when administrators export and open submissions in spreadsheet…

Is there a public PoC exploit available for CVE-2026-19501?

Yes, a public proof-of-concept exploit is available for CVE-2026-19501. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-19501?

Within 24 hours, identify all SureForms deployments and their versions, and determine which forms accept user-controlled field names. Within 7 days, implement interim controls such as disabling CSV export if operationally acceptable, or deploying WAF rules to block formula prefix characters (=, +, @, -) from field names. Concurrently, educate administrators to disable macros when opening CSV exports from forms. Within 30 days, evaluate alternative form plugins with active security maintenance and establish a transition plan, while monitoring vendor communications for security updates to SureForms.

SureForms CVE-2026-19501

EUVD-2026-60962 HIGH

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-08-18 certcc

GHSA-fwh8-67c4-8cgg

Information Disclosure Sureforms

8.8

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible form submission requires no auth (PR:N); administrator must open the CSV (UI:R); full workstation compromise yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 22:33 vuln.today

CVSS changed

Aug 21, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Aug 18, 2026 - 15:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 18, 2026 - 15:21 cve.org

HIGH 8.8

DescriptionCVE.org

CSV export functionality in Brainstorm Force SureForms version, <= 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

AnalysisAI

CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.

Technical ContextAI

CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes a class of injection where attacker-supplied input containing characters meaningful to spreadsheet parsers - typically '=', '+', '-', or '@' as the first byte of a cell value - is written directly into a CSV file without sanitization. SureForms, a WordPress form-builder plugin (CPE: cpe:2.3:a:sureforms:sureforms:*:*:*:*:*:*:*:*), exposes a CSV export feature for collected form submissions. Because the plugin does not strip or escape formula-initiating characters from user-controlled form field names prior to constructing the CSV, a malicious submitter can craft field names such as '=cmd|'/C calc.exe'!A0' or DDE-based payloads. Spreadsheet applications that auto-evaluate formulas on file open - a well-known behavior in Excel and LibreOffice - then trigger code execution on the machine of whoever opens the export file.

RemediationAI

No specific vendor-released patched version was identified in the available data at time of analysis; check the vendor site at http://sureforms.com and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-19501 for updated patch availability. As an immediate compensating control, administrators should refrain from opening SureForms CSV exports directly in Excel or LibreOffice Calc until a patch is confirmed; instead, import the CSV into a tool that does not auto-evaluate formulas, or open it in a plain-text editor. Disabling the 'Protected View' bypass prompts in Excel and ensuring macro/DDE execution is disabled via Group Policy reduces formula execution risk. Administrators can also validate and sanitize CSV exports server-side by prepending a tab character or single quote to any field value beginning with '=', '+', '-', or '@' - this is a well-established workaround for CWE-1236. Restricting which user roles can submit forms, or enabling CAPTCHA and moderation queues, reduces the attacker's ability to inject malicious payloads into the dataset in the first place.