CVE-2026-104368：The Export and Import Users and Customers plugin for WordPress is vuln

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash () escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

漏洞详情

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash () escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

风险评估

• CVSS 评分：8.8（HIGH）
• 评分版本：CVSS 3.1
• 攻击向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

弱点类型

CWE-116

参考链接

• https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvreader.php#L197
• https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvwriter.php#L154
• https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/export/export.php#L560
• https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/import/import.php#L490
• https://plugins.trac.wordpress.org/changeset/3741112/users-customers-import-export-for-wp-woocommerce
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4d358e43-f193-42fd-b49a-1b2a943183f2?source=cve

数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。

原文链接： CVE-2026-104368：The Export and Import Users and Customers plugin for WordPress is vuln