{"id":"CVE-2026-104368","published":"2026-10-30T05:16:57.833","lastModified":"2026-10-30T05:16:57.833","description":"The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (\") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvreader.php#L197","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvwriter.php#L154","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/export/export.php#L560","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/import/import.php#L490","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3741112/users-customers-import-export-for-wp-woocommerce","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d358e43-f193-42fd-b49a-1b2a943183f2?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}