NEWS

FE CSV Import & Export v1.0.3 Released | Security update hardening CSV uploads and blocking object & formula injection

Daijiro Miyazawa

2026.11.11

FE CSV Import & Export 1.0.3 is now available. Highlights:

Blocked direct web access to uploaded import CSVs – Uploaded CSV files are now moved directly into a protected temporary directory instead of the public uploads/YYYY/MM/ path, with .htaccess/index.php protection files written on every use and randomized temp file names. A one-time cleanup also removes orphaned CSV files left behind by earlier versions.
Prevented PHP object injection via imported custom field values – cf_ column values written directly to postmeta are now validated so crafted serialized payloads cannot instantiate PHP objects.
Neutralized spreadsheet formula injection in CSV exports – Cells starting with =, +, -, @, tab, or carriage return (including cf_ headers derived from meta keys) are prefixed with a single quote on export and restored on import, preventing formula execution when the CSV is opened in spreadsheet applications.
Applied the pre-import authentication filter on the import AJAX endpoint – fe_csv_import_export_pre_ajax_import now runs before any file processing so Pro access checks cover the full import flow.

Fixed import errors displaying as “undefined” in the log – Server-side rejections sent via wp_send_json_error() (e.g., Pro pre-check failures such as required re-authentication) now display the actual error message instead of undefined.