Order Export & Order Import for WooCommerce <= 2.8.0 - Unauthenticated CSV Row Injection via Order Export
- ID
- WPSEC-2026-2906
- Plugin
- Order Export & Order Import for WooCommerce (order-import-export-for-woocommerce)
- Affected
- all versions before 2.8.1
- Remediation
- Update to 2.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-116
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Order Export & Order Import for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to CSV Row Injection via the order export in all versions up to, and including, 2.8.0. The cause is that the export CSV writer calls fputcsv() with PHP's default backslash escape character, while the plugin's importer parses CSV files with RFC 4180 quoting. Order fields that contain a backslash followed by a double quote are therefore not escaped correctly. This makes it possible for unauthenticated attackers who can place an order, for example through guest checkout with a crafted customer note, to break out of a CSV field and add extra columns or rows to an exported file. If an administrator later re-imports that export, unintended orders can be created or existing orders modified.
References
- https://wpsec.com/vuln/WPSEC-2026-2906/
- https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/tags/2.8.1/
- https://wordpress.org/plugins/order-import-export-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS