CVE-2023-5527 is a high severity (CVSS 7.4) CSV injection flaw in the Business Directory Plugin for WordPress, versions up to and including 6.4.3. An author level user can plant content that runs as a formula when an administrator opens an exported CSV. Update the plugin and check the changelog for the fixed release.
What's affected
- Plugin: Business Directory Plugin for WordPress.
- Affected: all versions up to and including 6.4.3, in the CSV exporter file class-csv-exporter.php.
- Fixed version: not named in the NVD record. The plugin repository pages could not be read, so check the changelog for the first release after 6.4.3.
- Severity: 7.4 High in the NVD record.
- Privilege needed: author level or above, on the site that produces the export.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Business Directory Plugin. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Business Directory Plugin and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The plugin folder is usually business-directory-plugin.
A version of 6.4.3 or lower is in the affected range. Next, ask who has author level access to the directory and whether administrators routinely export listings to CSV and open them in a spreadsheet.
What to do now
- Update the plugin to the latest release and confirm that it is later than 6.4.3.
- Do not open CSV exports from a vulnerable version directly in a spreadsheet. Import them as plain text, or open them in a text editor first.
- Review author level and higher accounts on the site and remove ones that are no longer needed.
- Scan recent listings for cells that start with an equals sign, a plus sign, a minus sign or an at sign, since those are the characters spreadsheets treat as formulas.
- Tell the people who handle exports that the risk sits in the spreadsheet, not on the web server.
Why it matters
CSV injection, tracked as CWE-1236, works because spreadsheet programs treat some cell contents as formulas. If a web application writes user supplied text into a CSV without neutralizing it, the text becomes active content when someone opens the file in Excel or a similar tool. The record says an author can embed untrusted input into files exported by administrators, which can result in code execution on the machine that opens the export.
The interesting part is where the victim sits. The web server is not the target. The administrator's workstation is, and that machine often holds more access than the site itself. CleanTalk, who published a write-up for this CVE, says the flaw was found in a routine audit of the exporter file. The record does not list the CVE as known exploited, and the fix belongs in the plugin: exported cells should be escaped so they cannot start a formula.
Quick check
Does updating the plugin clean up old exports?
No. Files exported by a vulnerable version stay as they were. Treat them as untrusted until you have checked them or regenerated them after the update.
Sources
Last reviewed: 19 October 2026.
