Store Exporter <= 2.8.1 - Unauthenticated CSV Injection via Formula Escaping Bypass
- ID
- WPSEC-2026-1699
- Plugin
- Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers (woocommerce-exporter)
- Affected
- all versions before 2.8.2
- Remediation
- Update to 2.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-1236
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Store Exporter on WPSec AttackSurface
- Fix released
- Published
Description
The Store Exporter plugin for WordPress is vulnerable to CSV Injection via exported CSV and TSV files in all versions up to, and including, 2.8.1. This is due to insufficient neutralisation of spreadsheet formulas in exported cell values. Before 2.8.1 formulas were not neutralised at all. In 2.8.1 only the first character of each cell is checked, and rows are written with fputcsv() using a backslash escape character, so a quote that follows a backslash is not doubled. Such a quote can end a cell early and place attacker-supplied text at the start of a new cell, where the check never looks. This makes it possible for unauthenticated attackers to embed formulas in customer-controlled data, such as checkout billing or shipping fields. The formulas can run when a shop manager or administrator exports the data and opens the file in a spreadsheet application.
References
- https://wpsec.com/vuln/WPSEC-2026-1699/
- https://plugins.svn.wordpress.org/woocommerce-exporter/tags/2.8.2/
- https://wordpress.org/plugins/woocommerce-exporter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS