# Order Export & Order Import for WooCommerce <= 2.8.0 - Unauthenticated CSV Row Injection via Order Export

- **ID:** WPSEC-2026-2906
- **Plugin:** Order Export & Order Import for WooCommerce (`order-import-export-for-woocommerce`), https://wordpress.org/plugins/order-import-export-for-woocommerce/
- **Affected versions:** all versions before 2.8.1
- **Fixed in:** 2.8.1 (Update to 2.8.1 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-116
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/order-import-export-for-woocommerce
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2906/

## Description

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to CSV Row Injection via the order export in all versions up to, and including, 2.8.0. The cause is that the export CSV writer calls fputcsv() with PHP's default backslash escape character, while the plugin's importer parses CSV files with RFC 4180 quoting. Order fields that contain a backslash followed by a double quote are therefore not escaped correctly. This makes it possible for unauthenticated attackers who can place an order, for example through guest checkout with a crafted customer note, to break out of a CSV field and add extra columns or rows to an exported file. If an administrator later re-imports that export, unintended orders can be created or existing orders modified.

## References

- https://wpsec.com/vuln/WPSEC-2026-2906/
- https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/tags/2.8.1/
- https://wordpress.org/plugins/order-import-export-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2906/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.