{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/export-and-import-users-and-customers--2.7.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:export_and_import_users_and_customers_project:export_and_import_users_and_customers:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-104368"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Export and Import Users and Customers (\u003c= 2.7.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Export and Import Users and Customers plugin for WordPress contains a privilege escalation vulnerability (CVE-2026-104368) due to inconsistent CSV escape character handling. The exporter uses a backslash as the escape character, while the importer expects a double-quote. An attacker with Subscriber permissions can manipulate their Biographical Info field to inject a crafted CSV row that is interpreted as a new user creation during the import process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the WordPress site with Subscriber-level access.\u003c/li\u003e\n\u003cli\u003eAttacker updates their \u0026quot;Biographical Info\u0026quot; profile field with a crafted payload containing a backslash-quote sequence and a newline.\u003c/li\u003e\n\u003cli\u003eAn administrator performs a bulk export of users using the Export and Import Users and Customers plugin.\u003c/li\u003e\n\u003cli\u003eThe plugin exporter writes the attacker-controlled field to a CSV file, escaping it with a backslash.\u003c/li\u003e\n\u003cli\u003eThe administrator imports the modified CSV file back into the WordPress instance.\u003c/li\u003e\n\u003cli\u003eThe plugin importer parses the CSV using double-quote as an escape character, causing the injected newline to split the payload into a separate user record.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehf_create_customer()\u003c/code\u003e function processes the injected second row as a new user.\u003c/li\u003e\n\u003cli\u003eA new Administrator account is created with credentials specified in the payload.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated attacker can escalate their privileges to Administrator, gaining full control over the WordPress instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Export and Import Users and Customers plugin to a version beyond 2.7.5 immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts for suspicious Administrator profiles created by non-administrative users.\u003c/li\u003e\n\u003cli\u003eRestrict access to plugin export and import functionality to authorized administrators only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T07:20:18Z","date_published":"2026-10-30T07:20:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-plugin-priv-esc/","summary":"A CSV parsing vulnerability in the WordPress Export and Import Users and Customers plugin (\u003c= 2.7.5) allows authenticated attackers to escalate privileges to Administrator by injecting malicious records into exported user files.","title":"Export and Import Users and Customers: Privilege escalation in CSV import (CVE-2026-104368)","url":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-plugin-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Export and Import Users and Customers (\u003c= 2.7.5)","version":"https://jsonfeed.org/version/1.1"}