Is CVE-2026-104368 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104368 being exploited in the wild.

How severe is CVE-2026-104368?

High severity, with a CVSS score of 8.8, published 30 October 2026.

Which products and versions are affected?

WordPress.org Export and Import Users and Customers up to and including 2.7.5.

Is there a fix for CVE-2026-104368?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104368 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104368?

Check whether you run WordPress.org Export and Import Users and Customers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104368: Export and Import Users and Customers plugin privilege escalation

CVE-2026-104368 · Severity: high · CVSS 8.8 · Published 2026-10-30

The Export and Import Users and Customers plugin for WordPress allows authenticated Subscriber-level users to escalate their privileges to Administrator by injecting malicious data during the export-import workflow. An attacker can craft a biographical information field containing a special character sequence that causes the CSV parser to create a fake user record with administrative access. This allows account takeover and full website compromise.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-104368 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104368 being exploited in the wild.
How severe is CVE-2026-104368?: High severity, with a CVSS score of 8.8, published 30 October 2026.
Which products and versions are affected?: WordPress.org Export and Import Users and Customers up to and including 2.7.5.
Is there a fix for CVE-2026-104368?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104368 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104368?: Check whether you run WordPress.org Export and Import Users and Customers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a CSV escape-character mismatch between the exporter (using backslash escape) and importer (using double-quote escape) in class-csvwriter.php and class-csvreader.php. An authenticated attacker with Subscriber-level access can inject a crafted backslash-quote-newline sequence in the Biographical Info field, causing the CSV importer to parse the injected payload as a new user record with attacker-controlled login, password, email, and role, enabling arbitrary Administrator account creation.

Affected products

Wordpress.org Export and Import Users and Customers up to and including 2.7.5

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.