CVE-2022-2240CWE-1236

CVE-2022-2240: vulnerability in Request a Quote

Request a Quote <= 2.3.7 - CSV Injection

Published · Updated

Follow this CVE+ Monitor Request a Quote

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.4%
In short

The Request a Quote WordPress plugin up to version 2.3.7 allows anyone to upload a malicious CSV file without checking it first. When an admin downloads and opens this file, it can execute harmful commands on their computer.

Technical detail

The plugin fails to validate uploaded CSV files, allowing unauthenticated attackers to inject formula injection payloads (CWE-1236) via quote attachments. When an administrator downloads and opens the malicious CSV in spreadsheet software, the injected formulas execute with admin privileges, potentially leading to code execution or data exfiltration.

Summary generated and translated by AI from the official description.
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
Affected products
Unknown · Request a Quote
Related CVEs — Request a Quote

In the same product, most dangerous first.

CVE-2022-2239—Request a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24489—Request a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24420—Request a Quote < 2.3.4 - Authenticated Stored XSSEPSS 0.6%CVE-2024-6231MEDIUMRequest a Quote < 2.4.1 - Admin+ Stored XSSEPSS 0.4%CVE-2026-90988MEDIUMRequest a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenumEPSS 0.2%