CVE-2022-3026 in WP Users Exporter Plugin
Summary
by MITRE • 09/06/2022
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/08/2026
The WP Users Exporter plugin vulnerability represents a critical security flaw that exploits the CSV injection attack vector within WordPress ecosystems. This vulnerability specifically affects versions up to and including 1.4.2 of the plugin, making it a significant concern for WordPress administrators who rely on user export functionality for data management purposes. The flaw stems from inadequate input sanitization within the export mechanism, allowing malicious actors to inject dangerous code sequences that can execute when the exported files are opened on vulnerable systems.
The technical implementation of this vulnerability occurs through the 'Export Users' functionality where user profile data including first names and other personal information gets exported to CSV format. When an authenticated attacker with subscriber-level privileges inputs malicious content into their profile fields, this data becomes embedded within the exported CSV file. The vulnerability leverages the fact that CSV parsers in spreadsheet applications like Microsoft Excel and Google Sheets interpret certain character sequences as formulas, enabling attackers to execute arbitrary code on target systems when the CSV files are opened. This behavior aligns with CWE-1236, which specifically addresses CSV injection vulnerabilities in data export functionalities.
The operational impact of this vulnerability extends beyond simple data compromise as it enables full code execution capabilities on victim systems. When administrators download and open the malicious CSV files, the embedded formulas can trigger malicious payloads that may escalate privileges, install malware, or establish backdoors. This makes the vulnerability particularly dangerous in enterprise environments where administrators frequently handle user data exports and may not be aware of the security implications of opening seemingly benign CSV files. The attack requires minimal privileges since subscribers can exploit this flaw, making it a significant concern for WordPress installations with less restrictive user management policies.
Mitigation strategies should focus on immediate plugin updates to versions that address the CSV injection vulnerability, as well as implementing comprehensive input validation for all user profile fields. Administrators should also consider restricting user export permissions to only trusted administrators and implementing network-level controls to prevent automatic execution of downloaded files. The vulnerability demonstrates the importance of proper data sanitization in export functionalities and aligns with ATT&CK technique T1059.001 for command and script injection. Organizations should conduct thorough security audits of all WordPress plugins and implement automated patch management systems to prevent similar vulnerabilities from being exploited in the future.