CVE-2026-104368

Name of the Vulnerable Software and Affected Versions Export and Import Users and Customers plugin for WordPress versions prior to 2.7.6

Description An issue exists in the export and re-import workflow due to a CSV escape-character mismatch between the exporter and importer. The class-csvwriter.php file uses fputcsv() with the default backslash () escape character, whereas class-csvreader.php uses fgetcsv() with a double-quote (") escape character. An authenticated attacker with Subscriber-level access can exploit this by placing a crafted value in the Biographical Info field containing a backslash-quote sequence and a newline. This causes the importer to parse the data as two separate rows, allowing the hf create customer() function to process an injected row as a new user record. Consequently, the attacker can control the user login, user pass, user email, and role variables to create an unauthorized Administrator account and escalate privileges.

Recommendations Update the plugin to version 2.7.6 or later.