# Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Row Injection in Biographical Info

- **ID:** WPSEC-2026-0828
- **Plugin:** Export and Import Users and Customers (`users-customers-import-export-for-wp-woocommerce`), https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/
- **Affected versions:** all versions before 2.7.6
- **Fixed in:** 2.7.6 (Update to 2.7.6 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/users-customers-import-export-for-wp-woocommerce
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0828/

## Description

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation via CSV row injection in all versions up to, and including, 2.7.5. This is due to the CSV export writing fields with a backslash escape character while the importer parses files with RFC-style double-quote escaping, so a user-controlled profile field such as biographical info that contains a backslash followed by a double quote is not neutralized and can close the quoted field early. This makes it possible for authenticated attackers with subscriber-level access and above to craft profile data that injects additional columns and rows into a user export, which can create or modify accounts with the administrator role if an administrator later re-imports that file.

## References

- https://wpsec.com/vuln/WPSEC-2026-0828/
- https://plugins.svn.wordpress.org/users-customers-import-export-for-wp-woocommerce/tags/2.7.6/
- https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0828/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.