Export and Import Users and Customers
Export and Import Users and Customers imports and exports WordPress users and WooCommerce customers using structured data files.
Export and Import Users and Customers (users-customers-import-export-for-wp-woocommerce) is a WordPress plugin with 9 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 8.8.
users-customers-import-export-for-wp-woocommerceCVE-2026-104368: Export and Import Users and Customers: Privilege escalation through CSV row injection
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator. The structured affected range is <= 2.7.5.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-104368
Export and Import Users and Customers: Privilege escalation through CSV row injection
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator. The structured affected range is <= 2.7.5.
|
See mitigation notes |
CVE8.8
|
| Mar 22, 2025 |
CVE-2025-1973
Export and Import Users and Customers: Filesystem traversal
Export and Import Users and Customers is affected by filesystem traversal. Exploitation requires an authenticated administrator account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE4.9
|
| Mar 22, 2025 |
CVE-2025-1972
Export and Import Users and Customers: Arbitrary file deletion
Export and Import Users and Customers is affected by arbitrary file deletion. Exploitation requires an authenticated administrator account. A successful request can remove files outside the intended scope and may make the site unavailable.
|
See mitigation notes |
CVE2.7
|
| Mar 22, 2025 |
CVE-2025-1971
Export and Import Users and Customers: Code execution
Export and Import Users and Customers is affected by code execution. Exploitation requires an authenticated administrator account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
|
| Mar 22, 2025 |
CVE-2025-1970
Export and Import Users and Customers: Server-side request forgery
Export and Import Users and Customers is affected by server-side request forgery. Exploitation requires an authenticated administrator account. The vulnerable server can be induced to make attacker-selected network requests.
|
See mitigation notes |
CVE7.6
|
| Apr 24, 2024 |
CVE-2024-32835
Import Export WordPress Users: Code execution
Import Export WordPress Users is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE5.4
|
| Mar 29, 2024 |
CVE-2024-30492
Import Export WordPress Users: Filesystem traversal
Import Export WordPress Users is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE4.3
|
| Jan 11, 2024 |
CVE-2023-6558
Export and Import Users and Customers: Dangerous file upload
Export and Import Users and Customers is affected by dangerous file upload. Exploitation requires an authenticated shop manager account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE7.2
|
| Jul 18, 2023 |
CVE-2023-3459
Export and Import Users and Customers: A security weakness
Export and Import Users and Customers is affected by a security weakness. Exploitation requires an authenticated shop manager account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.2
|