Output validation vulnerability in Statify – Extended Evaluation 2.6.4

The Statify – Extended Evaluation plugin for WordPress is vulnerable to a type of attack called CSV Injection in versions up to and including 2.6.3. This type of attack allows someone with administrator level access to embed malicious code in a CSV file, which can be downloaded and opened on a local system with a vulnerable configuration. If opened, the malicious code can be used to gain access to the system.