Import and export users and customers <= 2.5.8 - Authenticated (Subscriber+) Privilege Escalation via CSV Export Cell Injection
- ID
- WPSEC-2026-1626
- Plugin
- Import and export users and customers (import-users-from-csv-with-meta)
- Affected
- all versions before 2.5.9
- Remediation
- Update to 2.5.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Import and export users and customers on WPSec AttackSurface
- Fix released
- Published
Description
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation via the user export and re-import workflow in all versions up to, and including, 2.5.8, due to the exporter writing CSV cells, and the importer reading them, with a NUL byte as the escape character without removing NUL bytes from exported values. A NUL byte placed before a quote stops fputcsv() from doubling that quote, while fgetcsv() reads the same bytes differently, so the cell boundaries shift and the rest of a profile value is parsed as extra columns and rows. This makes it possible for authenticated attackers, with subscriber-level access and above, to store crafted profile values that inject arbitrary user rows into the export, such as their own username with the administrator role, which are applied when a user with import and export permissions exports the users and imports the generated CSV again with role updates enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1626/
- https://plugins.svn.wordpress.org/import-users-from-csv-with-meta/tags/2.5.9/
- https://wordpress.org/plugins/import-users-from-csv-with-meta/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS