CVE-2024-3214 is a medium severity (CVSS 5.8) CSV injection flaw in the Relevanssi search plugin for WordPress, in versions up to and including 4.22.1. Untrusted input can end up in exported CSV files. Update the plugin to 4.22.2 or later and handle old exports with care.
What's affected
Relevanssi in all versions up to and including 4.22.1. The record says unauthenticated attackers can embed untrusted input into exported CSV files, which can lead to code execution when a file is opened on a local system with a vulnerable configuration. The linked changeset for the 4.22.2 tag touches lib/log.php, which suggests the search log export is the affected code. Confirm the fix note in the plugin changelog.
The vector needs user interaction, because someone has to export and open the file in a spreadsheet application.
CVE-2024-3213 affects the same plugin and versions.
The weakness class: CWE-1236, improper neutralization of formula elements in a CSV file. The NVD record scores it 5.8 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Read the plugin version on the Plugins page, or with WP-CLI:
wp plugin list --name=relevanssi --fields=name,version,update
Anything at 4.22.1 or lower is in range. Then think about files, not only software: any search log CSV exported before the update may hold unsafe cells.
What to do now
- Update Relevanssi to 4.22.2 or later.
- Treat CSV exports made before the update as untrusted. Open them in a viewer that does not evaluate formulas, or in plain text.
- Tell staff who export logs not to enable macros or external links when a spreadsheet prompts.
- Patch CVE-2024-3213 in the same update.
Why it matters
CWE-1236 covers improper neutralization of formula elements in a CSV file. Spreadsheet programs may treat a cell starting with certain characters as a formula, so text that came from a visitor can run as a formula for the person who opens the export. The record lists the CWE twice, a data quirk.
The risk lands on an administrator's own computer, not on the web server, which is why this class gets overlooked in server patching.
Quick check
Is the server itself at risk from CSV injection?
The described risk is on the machine that opens the exported file, not the web server. That makes the handling of exports, and the settings of the spreadsheet application, part of the fix as well as the plugin update.
Sources
- Relevanssi 4.22.2 changeset for log.php (listed in the record, not individually reviewed)
- Wordfence entry (listed in the record, not individually reviewed)
- Safeguard Gold entry for CVE-2024-3214
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
