Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection

Wordfence Intelligence   >   Vulnerability Database   >   Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection
7.3
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE CVE-2019-15092
CVSS 7.3 (High)
Publicly Published August 22, 2018
Last Updated January 11, 2023
Researcher Javier Olmedo

Description

The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.1 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.

References

Share

Vulnerability Details for Export and Import Users and Customers

Export and Import Users and Customers

Software Type Plugin
Software Slug users-customers-import-export-for-wp-woocommerce (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.3.2, or a newer patched version
Affected Version
  • < 1.3.2
Patched Version
  • 1.3.2

Recent vulnerabilities in Export and Import Users and Customers

Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
4.9
CVE-2025-1973
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
2.7
CVE-2025-1972
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
7.2
CVE-2025-1971
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
7.6
CVE-2025-1970
Mar 21, 2025
Researcher: HayMiz
Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection
7.2
CVE-2024-32835
Apr 22, 2024
Researcher: Trình Vũ
Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal
2.7
CVE-2024-30492
Mar 28, 2024
Researcher: Ananda Dhakal
Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload
7.2
CVE-2023-6558
Dec 12, 2023
Researcher: István Márton
Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
7.2
CVE-2023-3459
Jul 14, 2023
Researcher: István Márton
WebToffee Plugins <= (Various Versions) - Arbitrary User Creation
8.8
CVE-2020-12074
Mar 11, 2020
Researcher: Chloe Chamberland
# Title CVE ID CVSS Researchers Date
1 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function CVE-2025-1973 4.9 HayMiz March 21, 2025
2 Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function CVE-2025-1972 2.7 HayMiz March 21, 2025
3 Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2025-1971 7.2 HayMiz March 21, 2025
4 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function CVE-2025-1970 7.6 HayMiz March 21, 2025
5 Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection CVE-2024-32835 7.2 Trình Vũ April 22, 2024
6 Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal CVE-2024-30492 2.7 Ananda Dhakal March 28, 2024
7 Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload CVE-2023-6558 7.2 István Márton December 12, 2023
8 Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change CVE-2023-3459 7.2 István Márton July 14, 2023
9 WebToffee Plugins <= (Various Versions) - Arbitrary User Creation CVE-2020-12074 8.8 Chloe Chamberland March 11, 2020
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation