CVE-2022-3634: Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-21 · updated 2026-06-17

Description

The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection

Affected products

arshidkv12 Database Addon for Contact Form 7 – CFDB7: before 1.2.6.5 — fixed in 1.2.6.5

How to fix

Upgrade to a fixed version: arshidkv12 Database Addon for Contact Form 7 – CFDB7 1.2.6.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10
https://wpscan.com/vulnerability/b5eeefb0-fb5e-4ca6-a6f0-67f4be4a2b10

Get alerted when CVE-2022-3634 or the next vulnerability affects your stack