{
 "id": "WPSEC-2026-0828",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0828/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0828/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0828/index.md",
 "title": "Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Row Injection in Biographical Info",
 "description": "The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation via CSV row injection in all versions up to, and including, 2.7.5. This is due to the CSV export writing fields with a backslash escape character while the importer parses files with RFC-style double-quote escaping, so a user-controlled profile field such as biographical info that contains a backslash followed by a double quote is not neutralized and can close the quoted field early. This makes it possible for authenticated attackers with subscriber-level access and above to craft profile data that injects additional columns and rows into a user export, which can create or modify accounts with the administrator role if an administrator later re-imports that file.",
 "plugin": {
  "slug": "users-customers-import-export-for-wp-woocommerce",
  "name": "Export and Import Users and Customers",
  "full_name": "Export and Import Users and Customers",
  "wordpress_org": "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/users-customers-import-export-for-wp-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/users-customers-import-export-for-wp-woocommerce"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.7.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.7.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.7.6",
 "remediation": "Update to 2.7.6 or later.",
 "fix_released": "2026-10-12T10:33:34+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:13:33.210106+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0828/",
  "https://plugins.svn.wordpress.org/users-customers-import-export-for-wp-woocommerce/tags/2.7.6/",
  "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/users-customers-import-export-for-wp-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-13"
 }
}