Vulnerabilities / Alpha Addons for Gravity Forms / WPSEC-2026-1905
Alpha Addons for Gravity Forms <= 1.0.3 - Unauthenticated CSV Injection via Google Sheet Feed
Medium 5.4
CWE-1236Fixed in 1.0.4
- ID
- WPSEC-2026-1905
- Plugin
- Alpha Addons for Gravity Forms (alpha-addons-for-gravity-forms)
- Affected
- all versions before 1.0.4
- Remediation
- Update to 1.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Alpha Addons for Gravity Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Alpha Addons for Gravity Forms plugin for WordPress is vulnerable to CSV (formula) injection via form submissions sent to Google Sheets in all versions up to, and including, 1.0.3, due to submitted field values being appended to the connected sheet with USER_ENTERED parsing and without neutralizing values that begin with formula characters such as =, +, @ or -. This makes it possible for unauthenticated attackers to inject formulas into the connected spreadsheet when a Google Sheet feed is enabled for a form. The formulas run when the sheet is opened and can expose or alter data in it.
References
- https://wpsec.com/vuln/WPSEC-2026-1905/
- https://plugins.svn.wordpress.org/alpha-addons-for-gravity-forms/tags/1.0.4/
- https://wordpress.org/plugins/alpha-addons-for-gravity-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS