Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Row Injection in Biographical Info
- ID
- WPSEC-2026-0828
- Plugin
- Export and Import Users and Customers (users-customers-import-export-for-wp-woocommerce)
- Affected
- all versions before 2.7.6
- Remediation
- Update to 2.7.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-13
- Attack surface
- Export and Import Users and Customers on WPSec AttackSurface
- Fix released
- Published
Description
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation via CSV row injection in all versions up to, and including, 2.7.5. This is due to the CSV export writing fields with a backslash escape character while the importer parses files with RFC-style double-quote escaping, so a user-controlled profile field such as biographical info that contains a backslash followed by a double quote is not neutralized and can close the quoted field early. This makes it possible for authenticated attackers with subscriber-level access and above to craft profile data that injects additional columns and rows into a user export, which can create or modify accounts with the administrator role if an administrator later re-imports that file.
References
- https://wpsec.com/vuln/WPSEC-2026-0828/
- https://plugins.svn.wordpress.org/users-customers-import-export-for-wp-woocommerce/tags/2.7.6/
- https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS