The Spreadsheet Integration and Spreadsheet Integration Professional plugins for WordPress may be vulnerable to Cross-Site Request Forgery, or CSRF. This is a type of attack which can allow an attacker to access restricted areas or perform certain actions on a website without the administrator’s knowledge. In versions 3.5.0 and below, the plugin does not have the adequate security measures in place to stop this type of attack, specifically in the ‘wpgsi_WorksheetColumnsTitle’ function. An attacker could send a malicious link or file to a website administrator, and if the administrator clicks on it, the attacker could gain access to restricted areas and take certain actions without the administrator’s knowledge.
