Vulnerabilities / Payment Forms for Paystack / WPSEC-2026-1846
Payment Forms for Paystack <= 4.0.5 - Unauthenticated CSV Injection via Payment Form Submission Data
Medium 5.4
CWE-1236Fixed in 4.0.6
- ID
- WPSEC-2026-1846
- Plugin
- Payment Forms for Paystack (payment-forms-for-paystack)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Payment Forms for Paystack on WPSec AttackSurface
- Fix released
- Published
Description
The Payment Forms for Paystack plugin for WordPress is vulnerable to CSV Injection via payment form submission data in all versions up to, and including, 4.0.5 due to insufficient neutralization of spreadsheet formula characters in values written to the payment data export. This makes it possible for unauthenticated attackers to embed malicious formulas in submitted payment fields that may execute on the administrator's machine when the exported file is opened in a spreadsheet application, which requires an administrator to export and open the file.
References
- https://wpsec.com/vuln/WPSEC-2026-1846/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS