CVE-2026-124018 Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission
Unauthenticated attackers can submit formulas in Gutenverse Form submissions that execute when an admin opens exported CSV files, enabling data theft or command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-124018?
CVE-2026-124018 is a medium-severity code injection vulnerability in Jegstudio Gutenverse Form – Contact Form Builder, Block Form & Booking Form, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
Weakness: CWE-1236
Which versions are affected by CVE-2026-124018?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-124018?
No fix has been published for CVE-2026-124018 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-124018 being exploited?
There is no known exploitation of CVE-2026-124018 in the wild and no public exploit code.
Sources
Also known as GHSA-2q49-62r7-4h3r.