WordPress Simple User Import Export Plugin CSV Injection Vulnerability

A CSV injection vulnerability has been identified in the Simple User Import Export plugin for WordPress, affecting all versions through 1.1.7. The vulnerability arises in the 'Import/export users' function, where authenticated attackers with Administrator-level access can inject untrusted data into exported CSV files. This injected data may be executed as code when the CSV files are downloaded and opened on a local system with a vulnerable configuration.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on a user's local system, triggered by opening the manipulated CSV file.

Remediation

No patch is currently available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.