The AnWP Football Leagues plugin for WordPress contains a CSV injection flaw in its download functions, allowing an attacker with administrator or higher privileges to embed malicious input into CSV files. When these files are downloaded and opened in applications such as Excel, the injected content can be interpreted as executable formulas, leading to local code execution on the client system. The CVSS score of 4.8 reflects this moderate severity and the need for privileged access to exploit the vulnerability.

All installations of the AnWP Football Leagues plugin with a version of 0.16.17 or earlier are affected. The vulnerability applies to the WordPress plugin developed by anwppro, which is responsible for managing football leagues and player data.

The Exploit Prediction Scoring System indicates an exploitation probability of less than 1 % and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited current exploitation activity. However, the requirement for administrator‑level access means that the risk escalates if attackers can compromise an admin account or if the plugin is exposed to social engineering. The attack vector is inferred to be local execution after the CSV is opened on a victim’s machine, so securing admin credentials and limiting CSV usage are critical.