Security readout for executives and security teams
Plain-English summary
CVE-2022-3026 lets a logged-in WordPress user place spreadsheet content into profile fields that later appears in an admin’s exported user CSV. If the administrator opens that CSV in a vulnerable spreadsheet setup, the content may execute locally. This is not a direct server takeover, but it can create workstation risk through routine admin workflows.
Executive priority
Treat this as a moderate operational risk. Prioritize internet-facing WordPress sites with open registration or many low-privileged accounts, because the risk moves from the website into administrator workstations through exported CSV files.
Technical view
WP Users Exporter through 1.4.2 is reported vulnerable to CSV Injection in the Export Users function. Authenticated users, including subscribers, can supply untrusted profile data that is embedded into exported CSV output. The CVSS vector requires low privileges and user interaction, with changed scope and limited confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on WordPress sites running WP Users Exporter up to and including 1.4.2, especially where low-privileged users can register or edit profile fields and administrators export user CSV files.
Exploitation context
The source bundle does not show KEV listing or active exploitation. Exploitation depends on an authenticated attacker adding malicious profile data and an administrator downloading and opening the exported CSV in a vulnerable local spreadsheet configuration.
Researcher notes
Evidence is strongest for the vulnerability class, affected plugin, affected version range, and required interaction. The bundle does not provide a specific patched version, exploit-in-the-wild evidence, or detailed remediation instructions. CVE affected metadata appears sparse, so rely on the narrative and Wordfence references for version context.
Mitigation direction
- Inventory WordPress sites for WP Users Exporter and installed version.
- Check vendor or Wordfence guidance for a fixed version or removal advice.
- Disable or restrict user exports until affected installations are remediated.
- Avoid opening unsanitized exports from affected sites in spreadsheet software.
- Limit untrusted user registration or profile editing where operationally possible.
Validation and detection
- Confirm whether WP Users Exporter is installed and version is 1.4.2 or earlier.
- Review whether subscribers can edit fields included in user exports.
- Inspect recent user exports for unexpected spreadsheet formulas in profile-derived fields.
- Verify administrators have guidance not to open untrusted CSV exports.
- Document affected sites, export users, and remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1236: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-3026 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7da1d7cf-e8b5-4b7c-bdc1-13ef8c11b663?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/wp-users-exporter/trunk/A_UserExporter.class.phpCVE reference
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3026CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.