The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
| Link | Tags |
|---|---|
| https://wordpress.org/plugins/wordpress-popup/#developers | release notes |
| https://blog.reddy.io/category/cybersecurity/ | exploit third party advisory broken link |
| https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/ | exploit third party advisory broken link |
| https://wpvulndb.com/vulnerabilities/9326 | third party advisory |