IT SBIT Services
Schneeberger
DEEN
CVE tracker

Export and Import Users and Customers: Privilege escalation via CSV import

CVE-2026-104368High 8.8

← All vulnerabilities

Summary

The Export and Import Users and Customers plugin for WordPress contains a CSV escape-character mismatch between its export and import functions. An authenticated attacker with Subscriber-level access can store crafted content in the Biographical Info field, which is then parsed as a separate user record during re-import, allowing creation of an Administrator account. The attack requires an administrator to run the import for the injected record to be processed, which is not yet confirmed by the sources.

Affected

  • WordPress plugin Export and Import Users and Customers (slug users-customers-import-export-for-wp-woocommerce)
  • All versions up to and including 2.7.5

Fixed in

Unknown. No patched version has been confirmed by the vendor or the sources.

Workaround

  • Disable or restrict the user import function to a minimal set of trusted administrators until a fixed version is confirmed.
  • Remove unneeded Subscriber self-registration where possible.

Exploitation

  • No known exploitation in the wild (KEV: No).
  • Public proof of concept: not confirmed.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

  • Check whether the plugin is installed and at version 2.7.5 or earlier.
  • If so, disable the import function or limit it to trusted administrators until a fixed version is confirmed.
  • Audit administrator accounts and recent user creations for unknown entries.
  • Review whether Subscriber self-registration is required.
  • Apply the vendor fix as soon as it is published and verify the fixed version in the Wordfence record.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:46.

Original description (NVD)

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed