Auth0 WordPress Plugin CSV Injection Vulnerability

A CSV injection vulnerability has been identified in the Login by Auth0 WordPress plugin, affecting versions through 3.11.3. The issue arises because the plugin's data fields, which source information from various origins, lack proper input validation and sanitization before user data is exported. This oversight can be exploited by uploading a crafted Excel document that injects malicious CSV data.

Impact

Exploitation of this vulnerability allows for CSV injection, where malicious content is embedded in a CSV file that could be executed when the file is opened in a spreadsheet application like Microsoft Excel.

Remediation

Users can upgrade to Auth0 WordPress Plugin version 4.0.0 or later to address this vulnerability.