CVE-2022-46802 – This vulnerability allows attackers to inject m... (How to Fix)

Q: What is the severity of CVE-2022-46802?

CVE-2022-46802 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to inject malicious formulas into CSV files processed by the WooCommerce plugin, which can lead to arbitrary code execution when the CSV is opened in spreadsheet applications. It affects all WordPress sites using the Product Reviews Import Export for WooCommerce plugin version 1.4.8 and earlier. The attack can be performed without authentication.

📋 TL;DR

This vulnerability allows attackers to inject malicious formulas into CSV files processed by the WooCommerce plugin, which can lead to arbitrary code execution when the CSV is opened in spreadsheet applications. It affects all WordPress sites using the Product Reviews Import Export for WooCommerce plugin version 1.4.8 and earlier. The attack can be performed without authentication.

💻 Affected Systems

Products:

Product Reviews Import Export for WooCommerce WordPress plugin

Versions: n/a through 1.4.8

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations with the vulnerable plugin version, regardless of configuration.

📦 What is this software?

Product Reviews Import Export For Woocommerce by Webtoffee

View all CVEs affecting Product Reviews Import Export For Woocommerce →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution on the WordPress server, complete compromise of the WooCommerce store, theft of customer data, and financial fraud.

🟠

Likely Case

Data exfiltration, manipulation of product reviews, and potential privilege escalation within the WordPress environment.

🟢

If Mitigated

Limited to CSV formula injection affecting spreadsheet applications opening exported files, with no server-side code execution.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable without authentication and affects internet-facing WordPress/WooCommerce installations.

🏢 Internal Only: MEDIUM - Internal systems could still be affected if users open malicious CSV files, but attack surface is reduced.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

CSV injection attacks are well-documented and easy to weaponize. The vulnerability requires user interaction (opening CSV files) for full impact.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.4.9 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/product-reviews-import-export-for-woocommerce/wordpress-product-reviews-import-export-for-woocommerce-plugin-1-4-8-unauth-csv-injection-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Product Reviews Import Export for WooCommerce'. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 1.4.9+ from WordPress.org and replace the plugin files.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate product-reviews-import-export-for-woocommerce

Restrict CSV uploads

linux

Block CSV file uploads via web application firewall or .htaccess

# Add to .htaccess:
<FilesMatch "\.(csv)$">
Order Allow,Deny
Deny from all
</FilesMatch>

🧯 If You Can't Patch

Disable the plugin completely and use alternative review management methods
Implement strict input validation for all CSV uploads and sanitize formula characters (=, +, -, @)

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Product Reviews Import Export for WooCommerce → Version number

Check Version:

wp plugin get product-reviews-import-export-for-woocommerce --field=version

Verify Fix Applied:

Confirm plugin version is 1.4.9 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual CSV file uploads
Multiple failed CSV import attempts
CSV files with formula characters in content

Network Indicators:

POST requests to /wp-admin/admin-ajax.php with CSV data
CSV file downloads from unexpected sources

SIEM Query:

source="wordpress" AND (uri_path="/wp-content/plugins/product-reviews-import-export-for-woocommerce/*" OR file_extension="csv")

📊 Metadata

CVE ID: CVE-2022-46802

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-1236

Published: November 7, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-46802, you might also want to check these: