CVE-2020-36503
📋 TL;DR
This vulnerability in the Connections Business Directory WordPress plugin allows CSV injection through unvalidated/sanitized fields. Attackers can inject malicious formulas into exported CSV files, potentially executing code when opened in spreadsheet applications. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Connections Business Directory WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on systems opening malicious CSV files, data theft, or system compromise via formula injection in spreadsheet applications.
Likely Case
Data manipulation in exported CSV files, potential for phishing attacks via malicious content in business directory exports.
If Mitigated
Limited to CSV export manipulation with proper input validation and user education about opening untrusted files.
🎯 Exploit Status
Exploitation requires authenticated user access to input malicious data and victim opening CSV in vulnerable spreadsheet application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.7 and later
Vendor Advisory: https://github.com/Connections-Business-Directory/Connections/issues/474
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Connections Business Directory. 4. Click 'Update Now' if available. 5. Alternatively, download version 9.7+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable CSV Export
allTemporarily disable CSV export functionality in plugin settings
Input Validation Filter
allAdd custom input validation for connections fields
Add WordPress filter hooks to sanitize connections data before processing
🧯 If You Can't Patch
- Restrict user roles that can modify connections data
- Educate users about risks of opening untrusted CSV files in spreadsheet applications
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Connections Business Directory. If version is below 9.7, you are vulnerable.Check Version:
wp plugin list --name='connections' --field=versionVerify Fix Applied:
Confirm plugin version is 9.7 or higher and test CSV export functionality with malicious input attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export activity
- Multiple failed export attempts
- Suspicious field content in database logs
Network Indicators:
- Large CSV file downloads from business directory endpoints
SIEM Query:
source="wordpress" AND (event="csv_export" OR plugin="connections") AND suspicious_content_detected