CVE-2023-23796
📋 TL;DR
This CSV injection vulnerability in the Form Builder WordPress plugin allows attackers to inject malicious formulas into exported CSV files. When opened in spreadsheet applications like Excel, these formulas can execute arbitrary commands, potentially compromising user systems. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Form Builder | Create Responsive Contact Forms WordPress plugin
📦 What is this software?
Form Builder by Web Settler
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim's computer when they open a malicious CSV file, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Formula execution in spreadsheet applications leading to data exfiltration, system information disclosure, or execution of local commands.
If Mitigated
Limited impact if CSV files are opened in applications that sanitize formula input or if users are trained to not open untrusted CSV files.
🎯 Exploit Status
Exploitation requires user interaction (opening CSV file) but the injection itself is straightforward. Attackers need access to form submission data or ability to submit forms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.9.1
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Form Builder | Create Responsive Contact Forms'. 4. Click 'Update Now' if available, or download version 1.9.9.1+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable CSV Export
allTemporarily disable CSV export functionality in plugin settings
CSV Sanitization Filter
allAdd custom filter to sanitize CSV output before download
Add to theme's functions.php: add_filter('form_builder_csv_output', 'sanitize_csv_formulas'); function sanitize_csv_formulas($data) { return preg_replace('/^[=+\-@]/', "'", $data); }
🧯 If You Can't Patch
- Disable the Form Builder plugin entirely and use alternative form plugins
- Implement web application firewall rules to block CSV formula injection patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for 'Form Builder | Create Responsive Contact Forms' version 1.9.9.0 or earlierCheck Version:
wp plugin list --name='Form Builder' --field=versionVerify Fix Applied:
Verify plugin version is 1.9.9.1 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- CSV export requests with unusual parameters
- Form submissions containing formula characters (=, +, -, @)
Network Indicators:
- CSV file downloads from form export endpoints
- Unusual outbound connections after CSV downloads
SIEM Query:
source="wordpress" AND (url="*export-csv*" OR url="*download-csv*") AND (form_data="=*" OR form_data="+*" OR form_data="-*" OR form_data="@*")🔗 References
- https://patchstack.com/database/vulnerability/contact-form-add/wordpress-form-builder-create-responsive-contact-forms-plugin-1-9-9-0-csv-injection-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/contact-form-add/wordpress-form-builder-create-responsive-contact-forms-plugin-1-9-9-0-csv-injection-vulnerability?_s_id=cve
