The Simple User Import Export WordPress plugin contains a CSV injection flaw affecting all releases up to 1.1.7. The flaw arises when an authenticated Administrator uses the import/export feature to write untrusted data into exported CSV files. If a victim opens the exported file on a local system with a vulnerable spreadsheet or CSV parser, the injected formula or code can be executed, leading to arbitrary code execution on the victim’s machine. This weakness is identified as CWE-1236.

The vulnerability applies to the Simple User Import Export plugin by vaniivan, on WordPress sites that run any version of the plugin 1.1.7 or earlier. Administrators or users with higher privileges can trigger the flaw via the plugin’s import/export interface.

The CVSS score of 6.6 reflects a moderate severity, with the EPSS score indicating a very low probability of exploitation in the current environment and the vulnerability not listed in the CISA KEV catalog. Because an attacker must first be authenticated with Administrator-level access, the threat vector is limited to privileged users. However, once a CSV file containing injected payloads is exported, the risk shifts to any end user who subsequently opens the file locally on a system that interprets spreadsheet formulas, potentially allowing remote code execution on that user’s machine.