Export and Import Users and Customers: Privilege escalation in CSV import (CVE-2026-104368)

The Export and Import Users and Customers plugin for WordPress contains a privilege escalation vulnerability (CVE-2026-104368) due to inconsistent CSV escape character handling. The exporter uses a backslash as the escape character, while the importer expects a double-quote. An attacker with Subscriber permissions can manipulate their Biographical Info field to inject a crafted CSV row that is interpreted as a new user creation during the import process.

Attack Chain

1. Attacker authenticates to the WordPress site with Subscriber-level access.
2. Attacker updates their "Biographical Info" profile field with a crafted payload containing a backslash-quote sequence and a newline.
3. An administrator performs a bulk export of users using the Export and Import Users and Customers plugin.
4. The plugin exporter writes the attacker-controlled field to a CSV file, escaping it with a backslash.
5. The administrator imports the modified CSV file back into the WordPress instance.
6. The plugin importer parses the CSV using double-quote as an escape character, causing the injected newline to split the payload into a separate user record.
7. The hf_create_customer() function processes the injected second row as a new user.
8. A new Administrator account is created with credentials specified in the payload.

Impact

An authenticated attacker can escalate their privileges to Administrator, gaining full control over the WordPress instance.

Recommendation

• Update the Export and Import Users and Customers plugin to a version beyond 2.7.5 immediately.
• Audit existing user accounts for suspicious Administrator profiles created by non-administrative users.
• Restrict access to plugin export and import functionality to authorized administrators only.