CVE-2025-13133: WordPress Simple User Import Export RCE

CVE-2025-13133 Overview

CVE-2025-13133 is a CSV Injection vulnerability [CWE-1236] affecting the Simple User Import Export plugin (also distributed as a3-user-importer) for WordPress. The flaw exists in all versions up to and including 1.1.7 and is triggered through the plugin's Import/export users function. Authenticated attackers holding Administrator-level access or higher can embed untrusted formula content into exported CSV files. When a downstream user opens the exported CSV in a spreadsheet application with formula execution enabled, arbitrary code or commands can run on that user's local system.

Critical Impact
Malicious spreadsheet formulas embedded in exported user data can execute on any workstation that opens the CSV, extending compromise from a WordPress site into administrator endpoints.

Affected Products

WordPress Simple User Import Export plugin (a3-user-importer) versions ≤ 1.1.7
WordPress sites relying on the plugin for bulk user import/export workflows
Downstream endpoints opening exported CSVs in spreadsheet applications with formula execution enabled

Discovery Timeline

2025-11-18 - CVE-2025-13133 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13133

Vulnerability Analysis

The plugin exports user records to CSV without neutralizing spreadsheet formula characters. Fields that begin with =, +, -, @, tab, or carriage return are treated as formulas by Microsoft Excel, LibreOffice Calc, and Google Sheets. An attacker who can influence user data stored in WordPress, such as display names, usernames, or profile fields, can plant a payload that survives the export step untouched.

Exploitation requires Administrator-level privileges on the WordPress instance, which limits the initial attack surface. However, the impact crosses a security boundary: the malicious payload does not execute on the WordPress server. It executes on the endpoint of whoever downloads and opens the CSV. This makes the vulnerability useful for lateral movement from a compromised WordPress admin account into corporate workstations, or as a persistence mechanism when multiple administrators routinely export user data.

Root Cause

The root cause is missing output sanitization in the export routine. CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes exactly this pattern. The plugin writes user-controlled string values directly into CSV cells without prefixing dangerous leading characters with a single quote or wrapping the cell to force literal string interpretation.

Attack Vector

An Administrator authenticates to WordPress and modifies a user record so that a target field starts with a spreadsheet formula, for example a payload that invokes a shell command through =cmd|'/c calc'!A0 on Windows systems configured to permit dynamic data exchange. When another administrator uses the Import/export users function and opens the resulting CSV in a spreadsheet application that has not disabled formula execution or DDE, the payload runs in the context of the local user. No verified exploitation code has been published for this CVE.

Detection Methods for CVE-2025-13133

Indicators of Compromise

User profile fields, usernames, or display names that begin with =, +, -, @, or leading whitespace characters
Exported CSV files from the plugin containing cells with formula prefixes or references to cmd, DDE, HYPERLINK, or WEBSERVICE
Spreadsheet application child processes such as cmd.exe, powershell.exe, or wscript.exe spawned by excel.exe or soffice.bin

Detection Strategies

Scan the WordPress wp_users and wp_usermeta tables for entries whose values start with formula trigger characters
Inspect exported CSV artifacts in email gateways, SharePoint, and endpoint download folders for embedded formulas before distribution
Correlate spreadsheet process launches with subsequent script interpreter or command shell activity on administrator workstations

Monitoring Recommendations

Enable WordPress audit logging for user profile modifications, especially changes made by Administrator accounts
Alert on downloads of CSV files originating from /wp-admin/ paths and track which endpoints open them
Track Microsoft Office and LibreOffice telemetry for DDE prompts, macro execution, and unexpected external process launches

How to Mitigate CVE-2025-13133

Immediate Actions Required

Audit installed WordPress plugins for a3-user-importer at version 1.1.7 or earlier and disable it until a fixed release is deployed
Review all Administrator accounts and remove any that are unused, unrecognized, or lack multi-factor authentication
Sanitize existing user records by stripping or escaping leading =, +, -, @, tab, and carriage return characters

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Monitor the WordPress Plugin Directory listing and the Wordfence Vulnerability Report for updated version availability. Apply the fixed release across all WordPress sites as soon as it is published.

Workarounds

Restrict access to the Import/export users function through role-based capability controls until a patched version is available
Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange and block automatic formula execution on files from untrusted locations
Convert exported CSV files to a formula-neutral format such as XLSX with formulas disabled, or process them through a sanitizer that escapes leading formula characters

bash

# Configuration example: sanitize exported CSV files by prefixing risky cells with a single quote
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++){if($i ~ /^[=+\-@\t\r]/){$i="'\''"$i}} print}' exported_users.csv > sanitized_users.csv