{
 "id": "WPSEC-2026-1846",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1846/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1846/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1846/index.md",
 "title": "Payment Forms for Paystack <= 4.0.5 - Unauthenticated CSV Injection via Payment Form Submission Data",
 "description": "The Payment Forms for Paystack plugin for WordPress is vulnerable to CSV Injection via payment form submission data in all versions up to, and including, 4.0.5 due to insufficient neutralization of spreadsheet formula characters in values written to the payment data export. This makes it possible for unauthenticated attackers to embed malicious formulas in submitted payment fields that may execute on the administrator's machine when the exported file is opened in a spreadsheet application, which requires an administrator to export and open the file.",
 "plugin": {
  "slug": "payment-forms-for-paystack",
  "name": "Payment Forms for Paystack",
  "full_name": "Payment Forms for Paystack",
  "wordpress_org": "https://wordpress.org/plugins/payment-forms-for-paystack/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payment-forms-for-paystack/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.6",
 "remediation": "Update to 4.0.6 or later.",
 "fix_released": "2026-10-27T14:17:11+00:00",
 "published": "2026-10-28T14:51:26+00:00",
 "updated": "2026-10-28T09:20:17.383663+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1846/",
  "https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/",
  "https://wordpress.org/plugins/payment-forms-for-paystack/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}