| 开发者 |
carazo
hornero |
|---|---|
| 更新时间 | 2026年8月2日 05:01 |
| 捐献地址: | 去捐款 |
| PHP版本: | 5.5 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
The plugin natively supports CSV files. If you need to import directly from Excel (XLSX, XLS) or LibreOffice (ODS) files without converting them first, the File Formats Addon adds support for those formats.
You should fill the first two columns with the next values: Username, Email. The next columns are totally customizable and you can use whatever you want. All rows must contains same columns. User profile will be adapted to the kind of data you have selected. If you want to disable the extra profile information, please deactivate this plugin after make the import.
You can use a column called id in order to make inserts or updates of an user using the ID used by WordPress in the wp_users table. We have two different cases:
We can use a column called "Password" to manage a string that contains user passwords. We have different options for this case:
Plugin can import serialized data. You have to use the serialized string directly in the CSV cell in order the plugin will be able to understand it as an serialized data instead as any other string.
Plugin can import lists as an array. Use this separator: :: two colons, inside the cell in order to split the string in a list of items.
You can use those labels if you want to set data adapted to the WordPress default user columns (the ones who use the function wp_update_user)
You can upload as many files as you want, but all must have the same columns. If you upload another file, the columns will change to the form of last file uploaded.
You can export a file with all your users data using "Export" tab. There you will be able to find some filters and options to prepare your export.
If you want to extend this plugin or use this plugin with any other, here you have a list with all hooks available in the plugin.
Thanks, donations help us to continue improving our plugins and allow us to give the best support in the forums Donate Here via PayPal.
Of course! In Codection we help you to import, migrate, synchronized, update or any other operation you will need to do with your users. Contact us at contacto@codection.com for more information.
You can get:
Yes. Export users from your old site using the Export tab, then import the resulting CSV into your new site. Hashed passwords can be transferred using the user_pass column so users keep their existing passwords without needing to reset them.
Yes. Add WooCommerce billing and shipping fields as columns in your CSV (e.g. billing_first_name, billing_email, shipping_address_1) and the plugin will populate them automatically when importing users with the customer role.
Yes. The plugin has addons for Advanced Custom Fields, BuddyPress/BuddyBoss, Paid Membership Pro, WooCommerce Memberships, WooCommerce Subscriptions and many others. Custom meta fields not covered by an addon can still be imported by using the meta key as the column header.
By default WordPress requires an email for every user. If you need to import users without one, the Allow No Email Addon removes that requirement.
Yes. The plugin checks for existing users by username and email before inserting. If a match is found the user is updated instead of created. You can also control whether passwords and roles are overwritten on update.
Scheduled exports are available via the Recurring Export Addon. It lets you configure periodic CSV exports of your users or WooCommerce customers and send them to a file path or remote destination automatically.
Yes. The Recurring Import tab lets you configure a periodic import from a file path or URL. The plugin will fetch and process the CSV automatically at the chosen interval (hourly, daily, weekly, etc.) without any manual action. The free version supports one recurring import task. If you need multiple simultaneous scheduled imports — each with its own file, interval, role and settings — the Recurring Import Addon removes that limitation.
Yes. Point the recurring import at a URL that your external system generates and the plugin will pull and process it on every scheduled run, keeping your WordPress users in sync automatically.
You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.
update_user_meta() without an authorization check, and sensitive keys (wp_capabilities, wp_user_level, role, Username, Email) are now hard-blocked from this fallback path. Previously a user with only the create_users capability (e.g. a Shop Manager, or any role delegated CSV-import rights) could escalate their own account to Administrator by uploading a CSV with a wp_capabilities columnmaybe_update_email()) now normalizes both the stored and CSV emails with strtolower(trim()) before comparing, so a case difference (e.g. John.Doe@Example.com vs john.doe@example.com) no longer triggers a false "email changed" event, unnecessary wp_update_user() calls, or duplicate account creationcreate update-emails option), the new account's username is now derived from the row's first_name/last_name when available (e.g. JohnDoe, with JohnDoe2, JohnDoe3... on collision) instead of always falling back to an opaque duplicated_username_XXXXXX loginbp_member_type CSV column is now matched case-insensitively against the header row, consistent with how password/user_pass are already matchedbp_member_type (Profile Type) import/export column, which was previously undocumented in the in-plugin help textrole column now correctly trims leading/trailing spaces from each comma-separated value (e.g. executive_member, tracker_exclude). The previous code called array_walk( $roles_cells, 'trim' ), which is a no-op because trim() does not modify its argument by reference, so roles with a stray space (as commonly added by spreadsheet tools like Google Sheets) were silently treated as invalid and ignoredgroup_id/group_name columns) now also trims each comma-separated value before matching it against an existing group, avoiding the same issue when assigning multiple groups per usersanitize_text_field() before being stored as user meta in save_extra_user_profile_fields(), closing a stored XSS vector where a low-privileged user (e.g. Subscriber) could stash an HTML/JS payload in a custom column (reported by Luca Laytynher (LyT))esc_html() before being rendered, preventing a stored XSS payload from executing in the administrator's browser via export.js's .html() insertion (reported by Luca Laytynher (LyT))bp_avatar CSV import no longer falls back to a raw file_get_contents() call for values that are neither a numeric attachment ID nor an http(s) URL, closing an arbitrary local file read / PHP stream wrapper vector (e.g. file:///etc/passwd, php://filter) (reported by Binesh Madharapu)bp_avatar remote URL fetch now disables automatic redirect following and re-validates every redirect hop against the same SSRF blocklist used for the initial URL, preventing an attacker-hosted URL from bypassing the gate via a 3xx redirect to an internal or cloud metadata address (reported by Binesh Madharapu)bp_avatar CSV import now also rejects link-local (169.254.0.0/16), carrier-grade NAT (100.64.0.0/10, 198.18.0.0/15) and other private IP ranges after resolving the URL's host, closing the remaining part of the SSRF where wp_safe_remote_get() alone still allowed requests to the cloud metadata endpoint 169.254.169.254 (reported by Binesh Madharapu)bp_avatar CSV import now fetches remote URLs with wp_safe_remote_get() instead of file_get_contents(), preventing a Server-Side Request Forgery that let an admin-supplied URL make the server request internal hosts, cloud metadata endpoints, or scan internal ports (reported by Binesh Madharapu)path_to_file field (Tools > Import and export users and customers) now requires a local path to have a .csv extension and to resolve inside the WordPress uploads directory, closing an arbitrary file read that allowed reading server files such as /etc/hosts, logs or config files (reported by Centesiman)current_user_can('promote_users') check (plus filtering against the actor's editable roles) before applying any role during import, preventing a user with only create_users from creating or promoting an account to Administratorcurrent_user_can('edit_user', $user_id) check before the raw user_pass hash and any other wp_users core field (e.g. user_email) reach the database for an existing user during importcurrent_user_can('edit_user', $user_id) check before an existing user's email is changed via wp_update_user() when updating users by matching usernameacui_email_template_selected AJAX handler now requires edit_others_posts (filterable via acui_capability) and verifies the requested post's post_type is acui_email_template, preventing a low-privilege authenticated user (e.g. Subscriber) from using the endpoint to read the title/content of arbitrary posts, including drafts and private posts, by IDacui_refresh_enable_email_templates AJAX handlercodection-security AJAX nonce is no longer generated on admin screens the current user isn't allowed to act oncurrent_user_can('edit_user', $user_id) check before every wp_set_password() call during import, preventing a user with create_users access from resetting passwords of accounts they are not authorised to editallow_update_emails vs update_emails_existing_users)maybe_enable_wordpress_core_emails never actually re-enabling the filters, because anonymous closures cannot be removed with remove_filterignored user count is now tracked in the results array and propagated correctly across batch steps