# Payment Forms for Paystack <= 4.0.5 - Unauthenticated CSV Injection via Payment Form Submission Data

- **ID:** WPSEC-2026-1846
- **Plugin:** Payment Forms for Paystack (`payment-forms-for-paystack`), https://wordpress.org/plugins/payment-forms-for-paystack/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payment-forms-for-paystack
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1846/

## Description

The Payment Forms for Paystack plugin for WordPress is vulnerable to CSV Injection via payment form submission data in all versions up to, and including, 4.0.5 due to insufficient neutralization of spreadsheet formula characters in values written to the payment data export. This makes it possible for unauthenticated attackers to embed malicious formulas in submitted payment fields that may execute on the administrator's machine when the exported file is opened in a spreadsheet application, which requires an administrator to export and open the file.

## References

- https://wpsec.com/vuln/WPSEC-2026-1846/
- https://plugins.svn.wordpress.org/payment-forms-for-paystack/tags/4.0.6/
- https://wordpress.org/plugins/payment-forms-for-paystack/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1846/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.