blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-17661

HIGH 8.8 CVSS 3.1
Published
November 8, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-1236
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.

Affected products and versions

  • n/a n/a — Versions not specified
  • admincolumns admin_columns — Version 3.4.6

References

  • www2.deloitte.com https://www2.deloitte.com/de/de/pages/risk/articles/wordpress-csv-injection.html Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record