{"metadata": {"vulnerability": "CVE-2026-104368", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-01T21:48:40.164Z", "date_only": false, "value": "2026-10-01T21:48:40.164Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-01T22:04:02Z", "date_only": false, "value": "2026-10-01T22:04:02.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104368", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-10-29T16:03:50Z", "date_only": false, "value": "2026-10-29T16:03:50.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104368", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-10-30T04:32:43.217Z", "date_only": false, "value": "2026-10-30T04:32:43.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T04:32:43.217Z", "date_only": false, "value": "2026-10-30T04:32:43.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104368", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T04:36:56.025Z", "date_only": false, "value": "2026-10-30T04:36:56.025442Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117528003568065566", "record": "CVE-2026-104368", "field": "creation_timestamp", "uuid": "d3cb1f29-3396-4baf-acae-828d2874ded8", "content": "CVE-2026-104368 Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (\") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field \u2014 containing a backslash-quote sequence followed by a newline \u2014 is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104368https://www.wordfence.com/threat-intel/vulnerabilities/id/4d358e43-f193-42fd-b49a-1b2a943183f2?source=cvehttps://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/import/import.php#L490https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvreader.php#L197https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/classes/class-csvwriter.php#L154https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.7.5/admin/modules/user/export/export.php#L560https://plugins.trac.wordpress.org/changeset/3741112/users-customers-import-export-for-wp-woocommerce#wordpress #webtoffee #ExportandImportUsersandCustomers#CVE_2026_104368#bot", "url": "https://infosec.exchange/users/cve/statuses/117528003568065566"}, {"timestamp": "2026-10-30T05:16:57Z", "date_only": false, "value": "2026-10-30T05:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9339-975X-GRVQ", "record": "GHSA-9339-975X-GRVQ", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T05:16:57.833Z", "date_only": false, "value": "2026-10-30T05:16:57.833", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104368", "record": "FKIE_CVE-2026-104368", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:32:01Z", "date_only": false, "value": "2026-10-30T06:32:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9339-975X-GRVQ", "record": "GHSA-9339-975X-GRVQ", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:32:01Z", "date_only": false, "value": "2026-10-30T06:32:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9339-975X-GRVQ", "record": "GHSA-9339-975X-GRVQ", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T11:47:09.118Z", "date_only": false, "value": "2026-10-30T11:47:09.118516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz3phluqs525", "record": "CVE-2026-104368", "field": "creation_timestamp", "uuid": "74c38e30-67ec-4ce3-9874-a490721f8c20", "content": "\ud83d\udfe0 CVE-2026-104368 - High (8.8)\n\nThe Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-104368/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz3phluqs525"}, {"timestamp": "2026-10-30T17:02:15.387Z", "date_only": false, "value": "2026-10-30T17:02:15.387922Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104368", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T17:02:15.387Z", "date_only": false, "value": "2026-10-30T17:02:15.387922Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104368", "record": "FKIE_CVE-2026-104368", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-30T17:02:26.821Z", "date_only": false, "value": "2026-10-30T17:02:26.821Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:02:26.821Z", "date_only": false, "value": "2026-10-30T17:02:26.821Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104368", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:17:12.020Z", "date_only": false, "value": "2026-10-30T17:17:12.020", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104368", "record": "FKIE_CVE-2026-104368", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-31T04:46:10.214Z", "date_only": false, "value": "2026-10-31T04:46:10.214137Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mz5ifq4spb2r", "record": "CVE-2026-104368", "field": "creation_timestamp", "uuid": "08738a24-9b01-4c89-a49a-9af72ca75f01", "content": "CVE-2026-104368: de Suscriptor a Administrador en WordPress\n\nUn Suscriptor se vuelve Administrador explotando el CVE-2026-104368 en un plugin de WordPress. Mir\u00e1 c\u00f3mo funciona el fallo y qu\u00e9 hacer hoy mismo\n\n#cve2026104368 #webtoffee #escalamientodeprivilegios #seguridadwordpress #pluginswoocommerce", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mz5ifq4spb2r"}, {"timestamp": "2026-11-01T00:00:19.031Z", "date_only": false, "value": "2026-11-01T00:00:19.031712Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mz7ivip5dy2t", "record": "CVE-2026-104368", "field": "creation_timestamp", "uuid": "9881b04f-2e60-4c73-aaae-f30b78814204", "content": "CVE-2026-104368. 8.8/10. Attackers exploit a CSV escape flaw in Export and Import Users and Customers to escalate privileges and hijack admin accounts.\n\nUpdate to 2.7.5 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mz7ivip5dy2t"}], "metrics": {"as_of": "2026-11-15T19:02:40.108Z", "anchors": {"origin": {"timestamp": "2026-10-30T04:32:43.217Z", "date_only": false, "value": "2026-10-30T04:32:43.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T04:32:43.217Z", "date_only": false, "value": "2026-10-30T04:32:43.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1434596.891635, "hours": 398.49913656527775, "days": 16.604130690219908, "min_seconds": 1434596.891635, "max_seconds": 1434596.891635, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T04:32:43.217Z", "date_only": false, "value": "2026-10-30T04:32:43.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104368", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T19:02:40.108Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}