CVE-2025-13133: WordPress Simple User Import Export RCE

CVE-2025-13133 Overview

CVE-2025-13133 is a CSV Injection vulnerability [CWE-1236] affecting the Simple User Import Export plugin (also distributed as a3-user-importer) for WordPress. The flaw exists in all versions up to and including 1.1.7 and is triggered through the plugin's Import/export users function. Authenticated attackers holding Administrator-level access or higher can embed untrusted formula content into exported CSV files. When a downstream user opens the exported CSV in a spreadsheet application with formula execution enabled, arbitrary code or commands can run on that user's local system.

Critical Impact

Malicious spreadsheet formulas embedded in exported user data can execute on any workstation that opens the CSV, extending compromise from a WordPress site into administrator endpoints.

Affected Products

• WordPress Simple User Import Export plugin (a3-user-importer) versions ≤ 1.1.7
• WordPress sites relying on the plugin for bulk user import/export workflows
• Downstream endpoints opening exported CSVs in spreadsheet applications with formula execution enabled

Discovery Timeline

• 2025-11-18 - CVE-2025-13133 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13133

Vulnerability Analysis

The plugin exports user records to CSV without neutralizing spreadsheet formula characters. Fields that begin with =, +, -, @, tab, or carriage return are treated as formulas by Microsoft Excel, LibreOffice Calc, and Google Sheets. An attacker who can influence user data stored in WordPress, such as display names, usernames, or profile fields, can plant a payload that survives the export step untouched.

Exploitation requires Administrator-level privileges on the WordPress instance, which limits the initial attack surface. However, the impact crosses a security boundary: the malicious payload does not execute on the WordPress server. It executes on the endpoint of whoever downloads and opens the CSV. This makes the vulnerability useful for lateral movement from a compromised WordPress admin account into corporate workstations, or as a persistence mechanism when multiple administrators routinely export user data.

Root Cause

The root cause is missing output sanitization in the export routine. CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes exactly this pattern. The plugin writes user-controlled string values directly into CSV cells without prefixing dangerous leading characters with a single quote or wrapping the cell to force literal string interpretation.

Attack Vector

An Administrator authenticates to WordPress and modifies a user record so that a target field starts with a spreadsheet formula, for example a payload that invokes a shell command through =cmd|'/c calc'!A0 on Windows systems configured to permit dynamic data exchange. When another administrator uses the Import/export users function and opens the resulting CSV in a spreadsheet application that has not disabled formula execution or DDE, the payload runs in the context of the local user. No verified exploitation code has been published for this CVE.

Detection Methods for CVE-2025-13133

Indicators of Compromise

• User profile fields, usernames, or display names that begin with =, +, -, @, or leading whitespace characters
• Exported CSV files from the plugin containing cells with formula prefixes or references to cmd, DDE, HYPERLINK, or WEBSERVICE
• Spreadsheet application child processes such as cmd.exe, powershell.exe, or wscript.exe spawned by excel.exe or soffice.bin

Detection Strategies

• Scan the WordPress wp_users and wp_usermeta tables for entries whose values start with formula trigger characters
• Inspect exported CSV artifacts in email gateways, SharePoint, and endpoint download folders for embedded formulas before distribution
• Correlate spreadsheet process launches with subsequent script interpreter or command shell activity on administrator workstations

Monitoring Recommendations

• Enable WordPress audit logging for user profile modifications, especially changes made by Administrator accounts
• Alert on downloads of CSV files originating from /wp-admin/ paths and track which endpoints open them
• Track Microsoft Office and LibreOffice telemetry for DDE prompts, macro execution, and unexpected external process launches

How to Mitigate CVE-2025-13133

Immediate Actions Required

• Audit installed WordPress plugins for a3-user-importer at version 1.1.7 or earlier and disable it until a fixed release is deployed
• Review all Administrator accounts and remove any that are unused, unrecognized, or lack multi-factor authentication
• Sanitize existing user records by stripping or escaping leading =, +, -, @, tab, and carriage return characters

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Monitor the WordPress Plugin Directory listing and the Wordfence Vulnerability Report for updated version availability. Apply the fixed release across all WordPress sites as soon as it is published.

Workarounds

• Restrict access to the Import/export users function through role-based capability controls until a patched version is available
• Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange and block automatic formula execution on files from untrusted locations
• Convert exported CSV files to a formula-neutral format such as XLSX with formulas disabled, or process them through a sanitizer that escapes leading formula characters

# Configuration example: sanitize exported CSV files by prefixing risky cells with a single quote
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++){if($i ~ /^[=+\-@\t\r]/){$i="'\''"$i}} print}' exported_users.csv > sanitized_users.csv