CVE-2026-104368: Improper Encoding (CVSS 8.8)

Description

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

Is your site exposed to CVE-2026-104368?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0035

Probability of exploitation

0.29%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-116 CWE-116

References

Other References

https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvreader.php#L197 https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvwriter.php#L154 https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/export/export.php#L560 https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/import/import.php#L490 https://plugins.trac.wordpress.org/changeset/3741112/users-customers-import-export-for-wp-woocommerce https://www.wordfence.com/threat-intel/vulnerabilities/id/4d358e43-f193-42fd-b49a-1b2a943183f2?source=cve

Frequently Asked Questions

What is CVE-2026-104368? +

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-104368? +

CVE-2026-104368 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0035, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-104368? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-57210

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies …

CVE-2026-63344

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys …

CVE-2026-102530

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog …

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C …

CVE-2026-94545

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, …

CVE-2026-125112

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys …