CVE-2025-8767 describes a CSV Injection vulnerability (CWE-1236) in the AnWP Football Leagues WordPress plugin affecting all versions up to 0.16.17. The issue arises from improper neutralization of formula elements in CSV exports generated by the 'download_csv_players' and 'download_csv_games' functions. Authenticated attackers with Administrator privileges can embed malicious input into CSV files, which may execute code when opened in vulnerable spreadsheet software. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

An authenticated user with Administrator-level access can inject malicious formula code into CSV files exported by the plugin. This can lead to code execution on the local machine of anyone who opens the CSV file in a spreadsheet application that processes such formulas. The impact is limited by the requirement for high privileges and user interaction to open the file, resulting in a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and exercise caution when opening CSV files exported from this plugin. Consider sanitizing or validating CSV content before export to neutralize formula elements if possible.