Contact Form 7 to Database Extension 2.10.32 – CSV Injection

Hi Snuwerd,
to exploit this vulnerability an attacker only needs access to any form that will be saved to the db and then exported as an excel file and downloaded.
The excel file will then execute the potentially malicous code on the computer of the person who opens the excel file.

Fix added in latest version
https://github.com/mdsimpson/contact-form-7-to-database-extension/releases/tag/2.10.36

Thanks a lot!

Will deleting the old version to install current delete any database data?

I’ve seen the answer someplace (that it doesn’t) but can’t find it. Might be old info.