CVE-2022-2429

HIGH 8.0CVE-2022-2429 · Published 06/09/2022 · updated 17/06/2026

In short

CVE-2022-2429 is a HIGH (CVSS 8.0) vulnerability affecting ultimate sms notifications for woocommerce (ultimatesmsnotifications).
Chance of exploitation in the next 30 days (EPSS): 0.93%, higher than 60.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ultimate sms notifications for woocommerce ultimatesmsnotifications	`≤ 1.4.1`	No fix yet

Description

The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

References

plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt · Release Notes
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free