CVE-2022-3558: Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-3558?
CVE-2022-3558 is a vulnerability in the Import and export users and customers WordPress plugin before version 1.20.5.
What is the severity of CVE-2022-3558?
CVE-2022-3558 has a severity level of high (8 on a scale of 1-10).
How does CVE-2022-3558 impact the plugin?
CVE-2022-3558 allows attackers to execute arbitrary code by exploiting a data escape vulnerability in the plugin's CSV file export feature.
How can I fix CVE-2022-3558?
To fix CVE-2022-3558, update the Import and export users and customers WordPress plugin to version 1.20.5 or higher.
Where can I find more information about CVE-2022-3558?
You can find more information about CVE-2022-3558 at the following references: [Reference 1](https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta), [Reference 2](https://wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6).