CVE-2020-9466: 
WordPress vulnerability analysis and mitigation

The Export Users to CSV plugin through version 1.4.2 for WordPress was found to be vulnerable to CSV Injection. The vulnerability was discovered on February 8, 2020, and was assigned CVE-2020-9466. This vulnerability affects websites using the Export Users to CSV WordPress plugin versions up to 1.4.2 (CVE Mitre).

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or LibreOffice Calc is used to open a CSV, any cells starting with '=' will be interpreted by the software as a formula. Maliciously crafted formulas can be used for performing attacks (Jinson Blog).

An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads (formula) into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and opens it, the payload gets executed and can lead to unintended actions such as redirections to unknown/harmful websites (Jinson Blog).

Since the plugin appears to no longer be actively maintained, it is recommended that users seek out alternative plugins for exporting user data. No official patch was released for this vulnerability (Jinson Blog).