# Store Exporter <= 2.8.1 - Unauthenticated CSV Injection via Formula Escaping Bypass

- **ID:** WPSEC-2026-1699
- **Plugin:** Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers (`woocommerce-exporter`), https://wordpress.org/plugins/woocommerce-exporter/
- **Affected versions:** all versions before 2.8.2
- **Fixed in:** 2.8.2 (Update to 2.8.2 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-1236
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-exporter
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1699/

## Description

The Store Exporter plugin for WordPress is vulnerable to CSV Injection via exported CSV and TSV files in all versions up to, and including, 2.8.1. This is due to insufficient neutralisation of spreadsheet formulas in exported cell values. Before 2.8.1 formulas were not neutralised at all. In 2.8.1 only the first character of each cell is checked, and rows are written with fputcsv() using a backslash escape character, so a quote that follows a backslash is not doubled. Such a quote can end a cell early and place attacker-supplied text at the start of a new cell, where the check never looks. This makes it possible for unauthenticated attackers to embed formulas in customer-controlled data, such as checkout billing or shipping fields. The formulas can run when a shop manager or administrator exports the data and opens the file in a spreadsheet application.

## References

- https://wpsec.com/vuln/WPSEC-2026-1699/
- https://plugins.svn.wordpress.org/woocommerce-exporter/tags/2.8.2/
- https://wordpress.org/plugins/woocommerce-exporter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1699/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.