CVE-2022-2240

HIGH

Published Jul 25, 20223y ago · Modified Jun 17, 20261w ago

8.8 CVSS 3.1

High

Published Jul 25, 2022 3y ago

Last Modified Jun 17, 2026 1w ago

Description

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-1236

Affected Products 1

Vendor	Product	Version	Range
emarketdesign	request_a_quote	*	≤2.3.7

References 1

wpscan.com https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.