{
 "id": "WPSEC-2026-2906",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2906/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2906/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2906/index.md",
 "title": "Order Export & Order Import for WooCommerce <= 2.8.0 - Unauthenticated CSV Row Injection via Order Export",
 "description": "The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to CSV Row Injection via the order export in all versions up to, and including, 2.8.0. The cause is that the export CSV writer calls fputcsv() with PHP's default backslash escape character, while the plugin's importer parses CSV files with RFC 4180 quoting. Order fields that contain a backslash followed by a double quote are therefore not escaped correctly. This makes it possible for unauthenticated attackers who can place an order, for example through guest checkout with a crafted customer note, to break out of a CSV field and add extra columns or rows to an exported file. If an administrator later re-imports that export, unintended orders can be created or existing orders modified.",
 "plugin": {
  "slug": "order-import-export-for-woocommerce",
  "name": "Order Export & Order Import for WooCommerce",
  "full_name": "Order Export & Order Import for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/order-import-export-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/order-import-export-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/order-import-export-for-woocommerce"
 },
 "type": "CSV INJECTION",
 "cwe": [
  "CWE-116"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.1",
 "remediation": "Update to 2.8.1 or later.",
 "fix_released": "2026-11-11T11:44:55+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:09:08.569134+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2906/",
  "https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/tags/2.8.1/",
  "https://wordpress.org/plugins/order-import-export-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/order-import-export-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}