CVE-2020-11548: 
WordPress vulnerability analysis and mitigation

The Search Meter WordPress plugin through version 2.13.2 contains a CSV injection vulnerability that allows user input from the search bar to be any formula. This vulnerability was discovered in April 2020 and affects the Search Meter plugin's export functionality (NVD, WPScan).

The vulnerability exists in the export functionality of the Search Meter plugin. When an administrator performs an export operation via wp-admin/index.php?page=search-meter Export, maliciously crafted search input can be executed as formulas in CSV files. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could allow an attacker to achieve remote code execution through CSV injection when an administrator exports search data. This could lead to complete system compromise (NVD, Exploit-DB).

The vulnerability was fixed in version 2.13.3 of the Search Meter plugin, which works around the Excel bug that could lead to exploits in downloaded search files. Users should update to version 2.13.3 or later to protect against this vulnerability (WordPress).