CVE-2022-1202 describes a CSV injection vulnerability in the WP-CRM WordPress plugin, affecting versions up to 1.2.1. This flaw arises from the plugin's failure to properly validate and sanitize fields when exporting user data to a CSV file. Rated 7.8 HIGH on the CVSS scale, this vulnerability has a low attack complexity and requires user interaction, but can lead to high impacts on confidentiality, integrity, and availability if exploited. An attacker could craft malicious input that, when exported and opened in a spreadsheet program, could execute arbitrary commands. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or proof-of-concept code. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.2.1CPE matchmatch criteria | cpe:2.3:a:usabilitydynamics:wp-crm:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.