CVE-2019-15092

Name of the Vulnerable Software and Affected Versions webtoffee WordPress Users & WooCommerce Customers Import Export plugin version 1.3.0

Description The issue allows CSV injection in the user url, display name, first name, and last name columns in an exported CSV file created by the WF CustomerImpExpCsv Exporter class.

Recommendations For version 1.3.0, consider avoiding the use of the WF CustomerImpExpCsv Exporter class until a patch is available. As a temporary workaround, restrict the export functionality to minimize the risk of exploitation.