Export and Import Users and Customers (<= 2.7.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/export-and-import-users-and-customers--2.7.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 07:20:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgExport and Import Users and Customers: Privilege escalation in CSV import (CVE-2026-104368)https://feed.craftedsignal.io/briefs/2026-10-wordpress-plugin-priv-esc/Fri, 30 Oct 2026 07:20:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wordpress-plugin-priv-esc/A CSV parsing vulnerability in the WordPress Export and Import Users and Customers plugin (<= 2.7.5) allows authenticated attackers to escalate privileges to Administrator by injecting malicious records into exported user files.The Export and Import Users and Customers plugin for WordPress contains a privilege escalation vulnerability (CVE-2026-104368) due to inconsistent CSV escape character handling. The exporter uses a backslash as the escape character, while the importer expects a double-quote. An attacker with Subscriber permissions can manipulate their Biographical Info field to inject a crafted CSV row that is interpreted as a new user creation during the import process.

Attack Chain

  1. Attacker authenticates to the WordPress site with Subscriber-level access.
  2. Attacker updates their "Biographical Info" profile field with a crafted payload containing a backslash-quote sequence and a newline.
  3. An administrator performs a bulk export of users using the Export and Import Users and Customers plugin.
  4. The plugin exporter writes the attacker-controlled field to a CSV file, escaping it with a backslash.
  5. The administrator imports the modified CSV file back into the WordPress instance.
  6. The plugin importer parses the CSV using double-quote as an escape character, causing the injected newline to split the payload into a separate user record.
  7. The hf_create_customer() function processes the injected second row as a new user.
  8. A new Administrator account is created with credentials specified in the payload.

Impact

An authenticated attacker can escalate their privileges to Administrator, gaining full control over the WordPress instance.

Recommendation

  • Update the Export and Import Users and Customers plugin to a version beyond 2.7.5 immediately.
  • Audit existing user accounts for suspicious Administrator profiles created by non-administrative users.
  • Restrict access to plugin export and import functionality to authorized administrators only.
]]>highadvisory