# Alpha Addons for Gravity Forms <= 1.0.3 - Unauthenticated CSV Injection via Google Sheet Feed

- **ID:** WPSEC-2026-1905
- **Plugin:** Alpha Addons for Gravity Forms (`alpha-addons-for-gravity-forms`), https://wordpress.org/plugins/alpha-addons-for-gravity-forms/
- **Affected versions:** all versions before 1.0.4
- **Fixed in:** 1.0.4 (Update to 1.0.4 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/alpha-addons-for-gravity-forms
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1905/

## Description

The Alpha Addons for Gravity Forms plugin for WordPress is vulnerable to CSV (formula) injection via form submissions sent to Google Sheets in all versions up to, and including, 1.0.3, due to submitted field values being appended to the connected sheet with USER_ENTERED parsing and without neutralizing values that begin with formula characters such as =, +, @ or -. This makes it possible for unauthenticated attackers to inject formulas into the connected spreadsheet when a Google Sheet feed is enabled for a form. The formulas run when the sheet is opened and can expose or alter data in it.

## References

- https://wpsec.com/vuln/WPSEC-2026-1905/
- https://plugins.svn.wordpress.org/alpha-addons-for-gravity-forms/tags/1.0.4/
- https://wordpress.org/plugins/alpha-addons-for-gravity-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1905/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.