{"id":"CVE-2026-104368","kind":"vulnerability","aliases":["CVE-2026-104368"],"related":[],"title":"WordPress Export and Import Users plugin lets subscribers become administrators","description":"The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (\") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.","summary":"The Export and Import Users and Customers WordPress plugin up to version 2.7.5 mismatches CSV escape characters between its exporter and importer. A subscriber can store a crafted Biographical Info value that, after export and re-import, creates a new Administrator account with attacker-chosen login and password.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","registration-closed"],"how_to_check":"- Check whether the Export and Import Users and Customers plugin is installed and its version is `2.7.5` or lower, in the WordPress admin Plugins page or the plugin's `readme.txt`\n- Check whether open registration allows Subscriber accounts, and whether anyone with the Import function can run the plugin's import","fix":"- Update the Export and Import Users and Customers plugin to a version later than `2.7.5`; the fixed version is not stated in the sources","status":"open","published_at":"2026-10-30T05:16:57+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","triaged_at":"2026-10-30T05:29:24+00:00","updated_at":"2026-10-30T05:29:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T05:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Export and Import Users and Customers plugin to a version later than `2.7.5`; the fixed version is not stated in the sources","reach":"internet","title":"WordPress Export and Import Users plugin lets subscribers become administrators","impact":"high","summary":"The Export and Import Users and Customers WordPress plugin up to version 2.7.5 mismatches CSV escape characters between its exporter and importer. A subscriber can store a crafted Biographical Info value that, after export and re-import, creates a new Administrator account with attacker-chosen login and password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker becomes administrator and takes over the WordPress site","analyst_note":"Confirm the fixed plugin version and whether the import step requires an administrator to run it, using the NVD entry and the plugin's changelog.","how_to_check":"- Check whether the Export and Import Users and Customers plugin is installed and its version is `2.7.5` or lower, in the WordPress admin Plugins page or the plugin's `readme.txt`\n- Check whether open registration allows Subscriber accounts, and whether anyone with the Import function can run the plugin's import","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","registration-closed"],"who_is_affected":"Sites running the Export and Import Users and Customers plugin at version 2.7.5 or lower are exposed. Exposure requires an authenticated Subscriber-level account, which open registration can provide, and an administrator running the plugin's export and re-import workflow for the attack to succeed. Sites without the plugin, or with it removed, can skip this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4381,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104368':13A,16A '-2026':12A,15A '2.7.5':37B,97C 'access':245C 'account':67B,233C 'administr':10A,66B,232C,253C 'allow':226C 'arbitrari':231C 'attack':70B,224C,240C 'attacker-chosen':69B 'attacker-control':223C 'authent':239C 'back':189C 'backslash':135C,172C 'backslash-quot':171C 'becom':9A 'biograph':53B,166C 'cell':128C 'charact':41B,118C,137C,154C 'chosen':71B 'class-csvreader.php':139C 'class-csvwriter.php':126C 'contain':169C 'control':225C 'craft':52B,159C 'creat':63B,205C 'creation':228C 'csv':39B,115C,185C 'custom':31B,81C,206C 'cve':11A,14A 'default':134C 'doubl':149C 'double-quot':148C 'email':218C 'entir':222C 'escal':89C,249C 'escap':40B,117C,136C,153C 'escape-charact':116C 'exist':111C 'export':2A,26B,44B,58B,76C,103C,122C 'fgetcsv':145C 'field':168C,186C 'file':143C 'follow':175C 'fputcsv':130C 'hf':204C 'host':20B 'import':4A,28B,46B,62B,78C,107C,125C,195C 'includ':96C 'info':54B,167C 'inject':197C 'let':7A 'level':244C 'login':72B,214C 'make':235C 'mismatch':38B,119C 'new':65B,209C 'newlin':178C 'packag':17B 'pars':140C,188C 'pass':216C 'password':74B 'php':132C 'plugin':6A,24B,33B,82C,100C 'possibl':237C 'privileg':88C,251C 'process':202C 'quot':150C,173C,184C 're':61B,106C 're-import':60B,105C 'record':211C 'result':157C 'role':220C 'row':193C,199C 'second':198C 'self':19B 'self-host':18B 'separ':192C 'sequenc':174C 'singl':183C 'store':50B,161C 'subscrib':8A,48B,164C,243C 'subscriber-level':242C 'two':191C 'use':131C,146C 'user':5A,29B,79C,210C,213C,215C,217C 'valu':55B,160C 'version':36B,92C 'via':98C 'vulner':86C,110C 'whose':212C 'wordpress':1A,21B,23B,32B,84C 'wordpress-plugin':22B 'workflow':108C 'write':127C 'written':180C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Export and Import Users and Customers plugin at version 2.7.5 or lower are exposed. Exposure requires an authenticated Subscriber-level account, which open registration can provide, and an administrator running the plugin's export and re-import workflow for the attack to succeed. Sites without the plugin, or with it removed, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T05:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104368","severity":null,"published_at":"2026-10-30T05:16:57+00:00","modified_at":"2026-10-30T05:16:57+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","fetched_at":"2026-10-30T05:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}