Privilege Escalation in Export and Import Users and Customers Plugin for WordPress

CVE-2026-104368

What is CVE-2026-104368?

The Export and Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access to escalate their privileges to an Administrator role. This issue arises from discrepancies in how CSV data is exported and imported. Specifically, the plugin's export process utilizes a backslash as an escape character, while the import function expects a double-quote as the escape character. This misalignment can lead to crafted input being processed incorrectly, where a maliciously formatted entry can generate an additional row during CSV import. Consequently, attackers can take control of user credentials and roles, thereby granting themselves elevated access to the WordPress site.

References