# Real Testimonials <= 4.1.1 - Unauthenticated CSV Injection via Testimonial Form Fields

- **ID:** WPSEC-2026-2876
- **Plugin:** Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials (`testimonial-free`), https://wordpress.org/plugins/testimonial-free/
- **Affected versions:** from 3.1.0 before 4.1.2
- **Fixed in:** 4.1.2 (Update to 4.1.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/testimonial-free
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2876/

## Description

The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to CSV Injection via testimonial fields submitted through the front-end testimonial form (such as the reviewer name, designation, company name and location) in all versions up to, and including, 4.1.1, due to the testimonial CSV export writing field values without neutralizing cells that begin with formula characters (=, +, -, @, tab, carriage return) and without quoting them. This makes it possible for unauthenticated attackers to submit a testimonial whose values are interpreted as spreadsheet formulas, or break out of their cell, when an administrator exports the published testimonials to CSV and opens the file in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-2876/
- https://plugins.svn.wordpress.org/testimonial-free/tags/4.1.2/
- https://wordpress.org/plugins/testimonial-free/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2876/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.