WebToffee Export Import CVE-2026-104368

Requires an authenticated account at Subscriber level or above (PR:L) so the attacker can write a crafted value into the Subscriber's Biographical Info field - specifically a backslash-quote sequence followed by a newline that exploits the mismatch between fputcsv() (backslash escape) in class-csvwriter.php and fgetcsv() (double-quote escape) in class-csvreader.php. Exploitation does NOT complete on its own: it additionally requires a privileged operator to run the plugin's own export workflow and then re-import the generated CSV, at which point the injected second row is processed by hf_create_customer(). The main limiting factors are therefore (1) attacker must obtain at least Subscriber access, and (2) an administrator must actually perform the export-then-re-import cycle on the affected data; sites that never round-trip exported user data back through import are not exposed.

This is a genuine but conditional privilege-escalation issue rather than a drop-everything emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects full confidentiality, integrity, and availability loss because successful exploitation yields an attacker-controlled Administrator account. However, several decision signals temper the raw score: no EPSS probability is supplied, the CVE is not on CISA KEV, and no public exploit is identified in the input, so this is not confirmed in-the-wild activity. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-exploited flaw. The most important nuance is a likely gap in the provided CVSS vector: it lists UI:N, yet the described mechanism only triggers when a privileged operator runs the plugin's export AND then re-import workflow over the file containing the malicious data - that is effectively privileged user interaction, which materially narrows real-world exploitability versus a pure remote-unauthenticated bug. Net: a real, patch-this-week priority for sites running this plugin with open or low-trust registration, but not a wormable mass-exploitation scenario on current evidence.

An attacker who holds (or self-registers for) a Subscriber account stores a crafted backslash-quote-plus-newline sequence in their Biographical Info field. Later, when an administrator uses the plugin to export users to CSV and then re-imports that CSV, the escape-character mismatch between the writer and reader splits the field into a second row, which hf_create_customer() processes as a brand-new account with attacker-chosen login, password, email, and the Administrator role. No public exploit code is identified at time of analysis, but the description documents the trigger precisely.