CVE-2026-104368: Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hfcreatecustomer() as a new user record whose userlogin, userpass, useremail, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated WordPress account with at least Subscriber-level access. They must be able to place a crafted value in their Biographical Info field and have the plugin's export-and-re-import workflow process the resulting CSV.
What conditions trigger the privilege escalation?
The issue is triggered when a CSV exported by the plugin is re-imported by the same plugin after a crafted Biographical Info value containing a backslash-quote sequence followed by a newline has been exported. The CSV parsing mismatch can cause the import to treat attacker-controlled data as a second user record, including an Administrator role.
How can I investigate whether exploitation may have occurred?
Review user accounts created through the plugin's import workflow, especially unexpected Administrator accounts. Also examine exported or imported CSV files and Subscriber Biographical Info values for backslash-quote sequences followed by newlines.