---
id: "CVE-2026-104368"
kind: "vulnerability"
aliases: ["CVE-2026-104368"]
title: "WordPress Export and Import Users plugin lets subscribers become administrators"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "registration-closed"]
published_at: "2026-10-30T05:16:57+00:00"
first_seen_at: "2026-10-30T05:28:35+00:00"
updated_at: "2026-10-30T05:29:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104368", "first_seen_at": "2026-10-30T05:28:35+00:00"}]
---

# WordPress Export and Import Users plugin lets subscribers become administrators

The Export and Import Users and Customers WordPress plugin up to version 2.7.5 mismatches CSV escape characters between its exporter and importer. A subscriber can store a crafted Biographical Info value that, after export and re-import, creates a new Administrator account with attacker-chosen login and password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Export and Import Users and Customers plugin is installed and its version is `2.7.5` or lower, in the WordPress admin Plugins page or the plugin's `readme.txt`
- Check whether open registration allows Subscriber accounts, and whether anyone with the Import function can run the plugin's import

## Fix

- Update the Export and Import Users and Customers plugin to a version later than `2.7.5`; the fixed version is not stated in the sources

## Timeline

- 2026-10-30T05:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104368

## From the sources

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_