{
 "id": "WPSEC-2026-1699",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1699/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1699/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1699/index.md",
 "title": "Store Exporter <= 2.8.1 - Unauthenticated CSV Injection via Formula Escaping Bypass",
 "description": "The Store Exporter plugin for WordPress is vulnerable to CSV Injection via exported CSV and TSV files in all versions up to, and including, 2.8.1. This is due to insufficient neutralisation of spreadsheet formulas in exported cell values. Before 2.8.1 formulas were not neutralised at all. In 2.8.1 only the first character of each cell is checked, and rows are written with fputcsv() using a backslash escape character, so a quote that follows a backslash is not doubled. Such a quote can end a cell early and place attacker-supplied text at the start of a new cell, where the check never looks. This makes it possible for unauthenticated attackers to embed formulas in customer-controlled data, such as checkout billing or shipping fields. The formulas can run when a shop manager or administrator exports the data and opens the file in a spreadsheet application.",
 "plugin": {
  "slug": "woocommerce-exporter",
  "name": "Store Exporter",
  "full_name": "Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-exporter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-exporter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-exporter"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-1236"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.2",
 "remediation": "Update to 2.8.2 or later.",
 "fix_released": "2026-10-26T06:08:19+00:00",
 "published": "2026-10-27T06:43:48+00:00",
 "updated": "2026-10-26T09:45:55.975130+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1699/",
  "https://plugins.svn.wordpress.org/woocommerce-exporter/tags/2.8.2/",
  "https://wordpress.org/plugins/woocommerce-exporter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-exporter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}