cve/2021/CVE-2021-24144.md

### [CVE-2021-24144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24144)
![](https://img.shields.io/static/v1?label=Product&message=Contact%20Form%207%20Database%20Addon&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.2.5.6%3C%201.2.5.6%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brighgreen)

### Description

Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files.

### POC

#### Reference
- https://wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48

#### Github
No PoCs found on GitHub currently.