=== Import and export users and customers === Contributors: carazo Donate link: https://codection.com/go/donate-import-users-from-csv-with-meta/ Tags: import users, export users, csv, migrate users, bulk import Requires at least: 5.5 Tested up to: 7.1 Stable tag: 2.5.13 License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html Bulk import and export WordPress users and WooCommerce customers from CSV, including roles, passwords and any custom meta. == Description == **Try it out on your free dummy site: Click here => [https://demo.tastewp.com/import-users-from-csv-with-meta](https://demo.tastewp.com/import-users-from-csv-with-meta)** Import, export and migrate WordPress users and WooCommerce customers from a CSV file. Bulk-create or update thousands of users in seconds, schedule automatic recurring imports from a local file or URL, and carry over roles, passwords and any custom meta field. Works with WooCommerce, BuddyPress, Advanced Custom Fields, Paid Membership Pro, WooCommerce Memberships, WooCommerce Subscriptions and many more. * Import CSV file with users directly to your WordPress or customers into WooCommerce * Import thousands of users or customers in only some seconds * Export users or customers to a CSV file, filtering by role or registered date * You can also import meta-data like data from WooCommerce customers * You can assign roles while importing. * Send a mail to every new user, this mails can be saved as templates and are fully customizable, before sending you can test it * You can also update users if the user is already in your WordPress * Create a cron task to import users periodically * Edit the metadata (you will be able to edit the metadata imported using metakeys directly in the profile of each user) * Extend the plugin using the hooks we provide * Compatible with WPML [read the documentation](https://wpml.org/documentation/plugins-compatibility/import-users-from-csv-with-meta-and-wpml/) to see how you can translate the front-end import and export users page and send translated email notifications to users Moreover this plugin is compatible with many other plugins to be able to import and include them data, subscriptions, memberships, etc. Take a look: * WooCommerce: to import the customer data * WooCommerce Memberships: to import memberships * WooCommerce Subscriptions: to create subscriptions associated with users while they are being imported * BuddyPress: to import custom BuddyPress avatars, fields, groups and roles * Advanced Custom Fields: to import data to the fields you define there * Paid Membership Pro: to import memberships, included compatibility with PMPro version 3 * Indeed Ultimate Membership Pro: to import memberships * Paid Member Subscriptions: to import memberships * Allow Multiple Accounts: plugin will allow the same rules importing than this plugin * Groups: to assign users to groups while importing * New User Approve: you can import users and approbe/wait for approve them * Users Group: to assign users to groups while importing * WP LMS Course: to enroll users in the courses while importing * WP Members: to import memberships * WP Users Group: to assign users to groups while importing * WooCommerce Membership by RightPress: to create memberships while users are being imported * WP Private Content Plus: To import and export the groups to which users are assigned If you have some problem or doubt: * Read our documentation * Ask anything in support forum, we try to give the best support ### **Common use cases** * Migrate users from one WordPress site to another * Bulk create or update WooCommerce customers from a spreadsheet * Sync users automatically from an external CRM or ERP via CSV * Onboard members to a membership site (Paid Membership Pro, WooCommerce Memberships) * Periodically import subscribers or students from an external list * Import users from the frontend using a shortcode ### **Premium addons** Need more? These addons extend the plugin for specific needs: * [Allow No Email](https://import-wp.com/plugins/allow-no-email-addon/?utm_source=wordpress.org&utm_medium=import-users-from-csv-with-meta&utm_campaign=readme): import users that do not have an email address * [File Formats](https://import-wp.com/plugins/file-formats-addon/?utm_source=wordpress.org&utm_medium=import-users-from-csv-with-meta&utm_campaign=readme): import users directly from XLSX, XLS and ODS spreadsheets, no need to convert them to CSV * [Recurring Import](https://import-wp.com/plugins/recurring-import-addon/?utm_source=wordpress.org&utm_medium=import-users-from-csv-with-meta&utm_campaign=readme): unlimited scheduled import tasks, each one with its own file, period, role and notification email * [Recurring Export](https://import-wp.com/plugins/recurring-export-addon/?utm_source=wordpress.org&utm_medium=import-users-from-csv-with-meta&utm_campaign=readme): schedule automatic exports of your users and customers * [Dokan](https://import-wp.com/plugins/dokan-addon/?utm_source=wordpress.org&utm_medium=import-users-from-csv-with-meta&utm_campaign=readme): import Dokan marketplace vendors ### **Usage** Once the plugin is installed you can use it. Go to Tools menu and there, there will be a section called _Insert users from CSV_. Just choose your CSV file and go! ### **CSV generation** You can generate CSV file with all users inside it, using a standar spreadsheet software like: Microsoft Excel, LibreOffice Calc, OpenOffice Calc or Gnumeric. You have to create the file filled with information (or take it from another database) and you will only have to choose CSV file when you "Save as..." the file. As example, a CSV file is included with the plugin. ### **Some considerations** Plugin will automatically detect: * Charset and set it to **UTF-8** to prevent problems with non-ASCII characters. * It also will **auto detect line-ending** to prevent problems with different OS. * Finally, it will **detect the delimiter** being used in CSV file == Frequently Asked Questions == = I get a "too many redirects" error on my site, how can I solve it? = This is caused by the option that forces the users to reset their password. When it is used, each of those users is redirected to their password page on every page load until they change it, and if that destination cannot be reached (for example, because wp-admin is blocked for customers or subscribers by WooCommerce, by a membership plugin or by a security plugin) the browser ends up in a redirection loop. Since version 2.4.12 the plugin detects this situation and gives up after 3 consecutive redirects, so the site stays usable, but you can also clear the flag for the users that are already affected: go to the plugin documentation tab and use the button that removes the force reset password metadata from all the users. If you want to change how many redirects are allowed before the plugin gives up, use the `acui_force_reset_password_max_redirects` filter (return 0 to disable the limit): `add_filter( 'acui_force_reset_password_max_redirects', function( $max ){ return 5; } );` = Which page are the users sent to when I force them to reset their password? = By default they are sent to their WordPress profile page. If WooCommerce or WP User Manager are active, they are sent to the password section of the account page of those plugins instead. You can point them anywhere else using the `acui_force_reset_password_edit_profile_url` filter, and you can add your own exceptions (pages where the redirection must not happen) using `acui_force_reset_password_redirect_condition`. == Screenshots == 1. Import dialog 2. Recurring import dialog 3. Export dialog 4. File sample 5. Extra profile information (user meta) == Changelog == = 2.5.13 - 2026-11-01 = * Fixed the recurring import running the first batch again and again without end when the data of the previous batch was not available in the next one, which also made the cron log grow until the settings page could not be loaded. This happened mainly in sites with a persistent object cache, because the batch data was saved in transients * The data shared between batches is now saved in a non autoloaded option of each import, which works with or without an object cache, and it is removed when the import ends * If the data of the previous batch cannot be found, the import is stopped with an error in the log instead of starting again from the first row * The log of each cron run is limited to 1 MB (filter acui_cron_log_max_size) and is no longer autoloaded * Manual imports in batches of different users no longer share the same batch data = 2.5.12 - 2026-10-30 = * Security: saving the cron task settings now checks every permission before storing anything, so a request that is rejected can no longer leave part of its settings saved * Security: when the cron task was configured by a user who cannot promote users, the unattended runs no longer reuse the role permission saved by a previous administrator = 2.5.11 - 2026-10-29 = * When some rows are skipped because they have no email, the import result now says how many and that the Allow No Email addon can import them * Uploading an XLSX, XLS or ODS file now explains that the File Formats addon can import it, instead of only saying that the file type is not valid * The import screen now mentions the Dokan addon when Dokan is active * New "Premium addons" section in the plugin description * Links to the premium addons now include campaign parameters to know which ones are useful * Fewer links in the plugin row of the Plugins screen: the coffee and premium support links are only in the sidebar of the import screen, and the RedSys and Ceca gateways link only appears on sites in Spanish or with a WooCommerce store based in Spain * The Import link in the Plugins screen is only shown to users who can import, and the Import and Export links no longer change the order of the other links of the row * Fixed a malformed jQuery selector in the users option of Tools > Export = 2.5.10 - 2026-10-29 = * Security fix (path traversal and file deletion): the batch importer trusted the file path sent back by the browser on every step, so a user allowed to import users could point it to a CSV outside the uploads folder and read its processed rows in the import log, or have a file whose name contained "acui-import-" deleted when the import finished. The path is now resolved and validated only on the first step and kept on the server for the rest of the batches, and only the temporary file created from an upload is deleted (reported by Rafael Honorato (honorato0)) * Security fix (SQL injection): the Paid Memberships Pro addons built the query that marks a membership as inactive by concatenating the membership_id column of the CSV. The query is now prepared with integer placeholders (reported by Rafael Honorato (honorato0)) * Security fix (stored XSS): the from and to attributes of the [export-users] shortcode were checked with a regular expression that only looked for a date anywhere in the value, and the attributes were printed in the hidden fields of the form without escaping, so a contributor could save a post with a from value like 2024-01-01"> and run JavaScript in the browser of an administrator previewing it. The dates must now be exactly YYYY-MM-DD and every attribute is escaped (reported by dzaku) * Fixed the to attribute of the [export-users] shortcode, which was always ignored because of a typo (reported by dzaku) * The [import-users] and [export-users] shortcodes now show a short notice to users who cannot create users instead of stopping the whole page with wp_die(), so a post containing them no longer breaks the page or the REST API for other visitors (reported by dzaku) * The acui_export_shortcode_button_text filter now really changes the text of the export button = 2.5.9 - 2026-10-23 = * Security fix (privilege escalation): a subscriber could store profile values ending with a NUL byte so that, when a user with import and export permissions exported the users and imported the generated CSV again, the closing quote of that cell was read as escaped and the rest of the value was parsed as new columns and rows, for example a row with their own username and the administrator role. The exporter now removes NUL bytes from every cell and, on PHP 7.4 or newer, the CSV is written and read without escape character (RFC 4180), so a cell can never break out of its quotes * Fixed the PHP 8.4+ deprecation notice about the str_getcsv() escape parameter when detecting the delimiter of the CSV file * Extra profile fields: new "Keep fields from previous files?" option, when it is checked the columns of a new CSV are added to the list of extra profile fields instead of replacing it, so there is no need to include empty columns for fields that the new users do not use * Extra profile fields: every field of the list can now be removed individually, the values already saved for each user are kept = 2.5.8 = * New bbPress addon * Force password change: when BuddyPress (with the Settings component) or bbPress is active, users are now sent to their front-end settings page (BuddyPress) or profile edit page (bbPress) instead of wp-admin/profile.php, so the back end can stay private. The URL can still be changed with the `acui_force_reset_password_edit_profile_url` filter * Force password change: the flag is now removed whenever the user really changes their password, from any place (BuddyPress settings, bbPress, WooCommerce My Account, the lost password form...), not only from wp-admin/profile.php * Force password change: the "Please change your password" notice is also shown on the BuddyPress settings page and the bbPress profile edit page = 2.5.7 = * Security fix (account takeover): the 2.5.6 fix closed every role-assignment path, but a user with only `create_users` could still save the Cron tab with their own "Path or URL of file that is going to be imported" and let the recurring import run with the privileges of an administrator. The scheduled run and "Run now" without session switched to the user selected in "User that runs the cron" (or to the first administrator when none was selected), so every per-user check in the importer passed: a CSV row with an existing administrator's username and a password reset that account's password, and the administrator running the cron could be taken over by matching its email and adding a `user_email` column. The Cron tab now records who saved it, and when that user cannot `edit_users` the import always runs as that same user (the scheduled run, "Run now" and "Run now" without session), and the "User that runs the cron" selector only offers their own account. "Run now" without session also takes the role-assignment decision from the user who configured the task instead of from the user who clicks the button = 2.5.6 = * Security fix (privilege escalation hardening): a user with only `create_users` could still change other users' roles without `promote_users`. Saving the Cron tab now requires `promote_users` to set "Update roles for existing users?" to anything other than "No" or to enable "Change role of users that are not present in the CSV" (until now only the target role was checked, so the option could be enabled while keeping a previously stored role). The importer also no longer removes the existing roles of updated users when the user running the import cannot assign roles, which previously left them with no role when no role was being assigned = 2.5.5 = * The "Update roles for existing users?" option in the Cron import tab is now a selector with the same three choices as the manual importer: "No", "Yes, update and override existing roles" and "Yes, add new roles and do not override existing ones". Until now it was a checkbox that could only override the existing roles, so recurring imports had no way to add the roles from the CSV while keeping the ones users already had. Existing settings are kept: a checked box is read as "Yes, update and override existing roles" and an unchecked one as "No" * Fixed "Yes, add new roles and do not override existing ones" still replacing the roles of existing users on multisite when the row had no role to assign (no `role` column and role assignment disabled): the user was re-added to the current site as Subscriber, which removed the roles they already had there. Existing members of the site now keep their roles in that case, and only users that are not yet members of the site are added as Subscriber = 2.5.4 = * Security fix (privilege escalation): batched imports (both the manual "Import" tab, which runs in batches once the file is large enough, and the recurring Cron import) resumed the next batch with `SplFileObject::seek()`, which counts physical lines in the file, while the resume position handed between batches was a count of CSV records. Any exported column whose value can contain a newline — for example the Biographical Info profile field, which is editable by every role and stored verbatim by WordPress core — could make those two counts diverge once such a value was present before the batch boundary. When they diverged, the next batch could resume in the middle of an open quoted field, and the remaining lines that a user had put inside that one cell were then parsed as top-level CSV records in their own right, under the importing administrator's own role/password-assignment capabilities. The resume position is now the exact byte offset (`ftell()`/`fseek()`) at which the last fully parsed CSV record ended, so a batch can only ever resume at a genuine record boundary = 2.5.2 = * Security fix (privilege escalation): the role-assignment guards in the importer honoured a `caller_can_promote_users` value taken straight from the submitted form data instead of checking the current user's capability. That value is only legitimate on the Action Scheduler cron path, where it is derived from a capability at schedule time; on every request-driven import path (the manual backend importer and the AJAX batch import action the plugin UI uses) the form data is the raw request, so a user with only `create_users` could add `caller_can_promote_users=1` to the request themselves and get the `administrator` role applied, including to their own account. The pre-recorded decision is now only trusted on the cron path; every request-driven path re-derives it from the current user's own capabilities (reported by yzx001) * Security fix (privilege escalation): the front-end shortcode importer's "change role of users that are not present in the CSV" feature read the `acui_frontend_change_role_not_present` / `acui_frontend_change_role_not_present_role` options with no capability check of its own, and those options could be set by anyone able to reach the settings screen, which is gated only on `create_users`. A user with only `create_users` could point the option at `administrator` and then run the front-end importer to promote every existing editable-role user omitted from the CSV to administrator. Saving those two options now requires `promote_users`, matching the equivalent Cron tab option, and the front-end import path now also requires `promote_users` before honouring the option at run time (reported by BINESH MADHARAPU) = 2.5.3 = * Fixed the `[export-users]` shortcode's `columns` attribute whitelist (added in 2.5.1 to allow the `key=>Label` renaming syntax) still stripping the whole attribute to empty when the custom label contained accented or other non-ASCII letters (for example `columns="first_name=>Prénom"`), since the whitelist only matched plain ASCII letters = 2.5.1 = * Fixed the `[export-users]` shortcode dropping the `columns` attribute when it used the `key=>Label` renaming syntax (for example `columns="user_email=>Email,first_name=>First name"`), which caused all columns to be exported instead of just the selected ones. The `=` and `>` characters were not part of the shortcode attribute's whitelist and made it get sanitized down to an empty value = 2.5 = * Security hardening: exporting users is now gated by its own `acui_export_capability` filter (default `edit_users`) instead of sharing the `acui_capability` filter used by import. Previously, any site that lowered `acui_capability` to give a role import-only access (for example, to `add_users`) was also handing that same role access to the Export tab and its download/save endpoints, since both checks resolved to the exact same filter call with no way to tell them apart. The Export tab, its nav link, the plugin list "Export" action link and the export AJAX/download handlers now check the new filter independently, so an import-only role stays import-only unless the new filter is explicitly overridden * The "Update existing users?" section on the Import tab now hides the "Update emails?", "Update roles for existing users?" and "Update passwords for existing users?" fields when "Update existing users?" is set to "No", since they have no effect in that case = 2.4.18 = * Security fix (privilege escalation): the CSV exporter writes fields with the NUL character as the escape character (`fputcsv(..., '"', "\0")`), but the importer's `SplFileObject::fgetcsv()` calls were passing only the delimiter, which silently kept PHP's default backslash escape character. Any registered user able to save their own profile could set `display_name` to a value ending in a comma and a backslash (e.g. `a,\`) and `nickname` to a value starting and ending with a comma around a role name (e.g. `,administrator,q`). When an administrator later used the plugin's own Export tab and re-imported that file with "Update existing users" and "Update roles for existing users" both set to "yes" — the plugin's documented backup/migration workflow — the escape mismatch merged the `display_name` cell into the `role` column and split the `nickname` cell, so the parsed role column for the attacker's own row read exactly `administrator`, and the administrator's own authorized import call applied it. The importer's `fgetcsv()` calls now use the same explicit escape character as the exporter, so no combination of profile field values can shift the parsed column boundaries * Security fix (hardening): as defense in depth for the same code path, assigning the `administrator` role during an import now additionally requires the `create_users` capability (not only `promote_users`) on the account running the import. This does not change behavior on sites using the plugin's own default access gate, but stops a future column-shift bug — or a site that has lowered the `acui_capability` filter to allow non-administrators to run imports — from being able to deliver an `administrator` role assignment through a CSV. Other roles present on the same row are unaffected; only `administrator` is dropped (with a warning) when `create_users` is missing = 2.4.17 = * Security fix (privilege escalation): the 2.4.16 fix only closed the literal `acui_fire_cron_no_session` no-session action; it did not close the same gap on a genuinely unattended run of the recurring import (an Action Scheduler queue tick, with no `$caller_can_promote_users` argument at all). A user with only `create_users` could leave the Cron tab's default role empty (so the `promote_users` gate on that field was never tripped), point the recurring import at an attacker-controlled CSV with its own `role` column set to `administrator`, and activate it. On the next unattended tick, the execution user still falls back to the site's first Administrator, and the per-row role check evaluated that substituted Administrator's own capability rather than the capability of whoever had actually configured the task, so the CSV-supplied `administrator` role was applied. Whether an unattended cron run may apply any role, including one carried in the CSV's own role column, is now decided by the `promote_users` capability of the user who last saved the Cron tab settings, recorded at save time, instead of being re-derived from the (possibly substituted) execution user at run time * Security fix (privilege escalation): the manual backend import ("Import" tab) only required `create_users` to run at all, but let the request also enable "delete users not present" and "change role of users not present" without holding `delete_users` or `promote_users` respectively — the same gap that the Cron tab already had fixed in 2.4.15. Both options on the manual import now also require the matching capability = 2.4.16 = * Security fix (privilege escalation): the 2.4.15 fix gated the Cron tab's stored default role and execution user, but not the "Run now" no-session action (`acui_fire_cron_no_session`) itself, nor the role that a CSV row can carry in its own role column. A user with only `create_users` could still save an attacker-controlled file path (not gated by `promote_users`) and trigger that no-session run, which clears the current user and falls back to the site's first Administrator; the per-row role check then saw that substituted Administrator's capabilities instead of the actual caller's, so a role of `administrator` delivered through the CSV itself (rather than the stored default) was still accepted. The role assignment check on every cron-triggered run, including multi-step batches, now uses the capability of the user who actually triggered the run instead of the capability of the substituted execution user = 2.4.15 = * Security fix (privilege escalation): saving the Cron tab settings (`acui_cron_save_settings`) checked only the shared plugin nonce and, for the "User that runs the cron" field, that the selected user held the same broad menu capability (`create_users` by default) as whoever was saving. This let a user with `create_users` but not `promote_users` (or `delete_users`) select an Administrator as the execution identity, set the default role to `administrator`, or enable "delete users not present"/"change role of users not present", and then trigger the "Run now" no-session action, which runs the import with no logged-in user and falls back to the site's first Administrator. The `promote_users` check on role assignment and the missing capability checks on user deletion and role change only saw that substituted Administrator, not the actual caller, so a delegated importer could create a new Administrator account or delete/demote existing users. The Cron tab now requires `promote_users` to set a default role, to set the "change role of users not present" role, or to select an execution user that itself has `promote_users`, and requires `delete_users` to enable "delete users not present" * Security fix (hardening): the same settings are also now rejected outright (instead of silently ignored) when the current user lacks the required capability, so a misconfigured attempt fails loudly rather than saving a partial, inconsistent state = 2.4.14 = * Improvement: the "Path or URL of file that is going to be imported" field (manual import and Cron tab) now explains right on screen that a local path must be located inside the WordPress uploads folder, and shows the actual folder path of the site * Improvement: added a "Check path" button next to that field to verify, before saving or running the import, whether the entered path or URL will be accepted, and why not otherwise * Improvement: saving the Cron settings now shows a warning notice when the configured path is not a valid local path (wrong extension, file not found, or outside the uploads folder), instead of only failing silently at the next scheduled run * New: added the `acui_allowed_local_csv_base_dirs` filter so a developer can whitelist extra local base folders for the CSV path (e.g. a folder an external process writes to), without disabling the underlying security check added in 2.4.3 * Security fix (hardening): importing a CSV from a remote URL (manual import and Cron tab) now blocks link-local (`169.254.0.0/16`, including the cloud metadata endpoint `169.254.169.254`) and carrier-grade NAT (`100.64.0.0/10`, `198.18.0.0/15`) hosts, and re-validates every redirect hop against the same SSRF blocklist instead of letting `download_url()` follow redirects unchecked. This closes the same class of Server-Side Request Forgery that was already fixed for the BuddyPress/BuddyBoss `bp_avatar` import in 2.4.3/3.x, but that fix had not been applied to the main CSV-by-URL import path = 2.4.13 = * Improvement: the role errors during the import now say exactly what is wrong instead of always blaming permissions. The row is checked role by role and the message tells which single role failed and why: the role does not exist (and lists the roles that can be used), the role exists but the current user is not allowed to assign it (and lists which ones they can), or the role column is empty on that row. Before, a role that simply did not exist was reported as *"You do not have permission to assign some of the next roles"* whenever the "update roles of existing users" option was set to "no", because the "role does not exist" check was skipped in that case, and both messages printed the whole list of roles of the row instead of the offending ones * Improvement: when the CSV carries the name of the role (`Conference`) instead of its slug (`conference_member`), the error now points to the right slug instead of only saying that the role does not exist * Fix: roles whose slug contains uppercase letters (created that way by some role editor plugins) can be imported again. The values of the `role` column were lowercased but compared against the role slugs as they are stored, so those roles were always rejected as non existing or invalid * Fix: `ACUI_Helper::get_editable_roles()` uses `wp_roles()` instead of reading the `$wp_roles` global directly, which could still be uninitialized in cron or front end imports, leaving the list of editable roles empty and making every role of the CSV fail * Fix: a `role` cell containing the `::` list separator no longer produces a fatal error when the row is prepared = 2.4.12 = * Fix: the "force users to reset their password" option no longer produces "too many redirects" errors. The redirection ran on every front end page load and only stopped when the add-on condition matched exactly, so any setup where the destination could not be reached or recognized (wp-admin blocked for customers by WooCommerce or a membership plugin, a My account URL that did not match the `home_url()` string comparison because of trailing slashes, www, https or a language prefix, an account page built with blocks or a page builder instead of the shortcode...) sent the user back and forth forever. The redirection is now skipped when the user is already on the destination URL, it does not run on AJAX, REST, cron, XML-RPC or non GET requests, and a counter stops it after 3 consecutive redirects (filterable through the new `acui_force_reset_password_max_redirects` hook) so the worst case is that the password change is not enforced instead of the site being unreachable = 2.4.11 = * Security fix: the mail options save handler no longer writes to arbitrary posts. The `template_id` form field was passed straight to `wp_update_post()` without checking the post type or `current_user_can( 'edit_post' )`, so a user with only the `create_users` capability could overwrite the title and the content of any post or page of the site (and inject arbitrary CSS through the `

and
tags in body of emails. = 1.6.1 = * Thanks to Matthijs Mons: now this plugin is able to work with Allow Multiple Accounts (https://wordpress.org/plugins/allow-multiple-accounts/) and allow the possibility of register/update users with same email instead as using thme in this case as a secondary reference to the user as the username. = 1.6 = * Now options that are only useful if some other plugin is activated, they will only show when those plugins were activated * Thanks to Carmine Morra (carminemorra.com) for supporting the next two big features: * New role manager: instead of using a select list, you can choose roles now using checkboxes and you can choose more than one role per user * SMTP server: you can send now from your WordPress directly or using a external SMTP server (almost all SMTP config and SMTP sending logic are based in the original one from WP Mail SMTP - https://wordpress.org/plugins/wp-mail-smtp/). When the plugin finish sending mail, reset the phpmailer to his previous state, so it won't break another SMTP mail plugin. * And this little one, you can use **email** in mail body to send to users their email (as it existed before: **loginurl**, **username**, **password**) = 1.5.2 = * Thanks to idealien, if we use username to update users, the email can be updated as the rest of the data and metadata of the user and we silence the email changing message generated by core. = 1.5.1 = * Thanks to Mitch ( mitch AT themilkmob DOT org ) for reporting the bug, now headers do not appears twice. = 1.5 = * Thanks to Adam Hunkapiller ( of dreambridgepartners.com ) have supported all this new functionalities. * You can choose the mail from and the from name of the mail sent. * Mail from, from name, mail subject and mail body are now saved in the system and reused anytime you used the plugin in order to make the mail sent easier. * You can include all this fields in the mail: "user_nicename", "user_url", "display_name", "nickname", "first_name", "last_name", "description", "jabber", "aim", "yim", "user_registered" if you used it in the CSV and you indicate it the mail body in this way **FIELD_NAME**, for example: **first_name** = 1.4.2 = * Due to some support threads, we have add a different background-color and color in rows that are problematic: the email was found in the system but the username is not the same = 1.4.1 = * Thanks to Peri Lane for supporting the new functionality which make possible to activate users at the same time they are being importing. Activate users as WP Members plugin (https://wordpress.org/plugins/wp-members/) consider a user is activated = 1.4 = * Thanks to Kristopher Hutchison we have add an option to choose what you want to do with empty cells: 1) delete the meta-data or 2) ignore it and do not update, previous to this version, the plugin update the value to empty string = 1.3.9.4 = * Previous version does not appear as updated in repository, with this version we try to fix it = 1.3.9.3 = * In WordPress Network, admins can now use the plugin and not only superadmins. Thanks to @jephperro = 1.3.9.2 = * Solved some typos. Thanks to Jonathan Lampe = 1.3.9.1 = * JS bug fixed, thanks to Jess C = 1.3.9 = * List of old CSV files created in order to prevent security problems. * Created a button to delete this files directly in the plugin, you can delete one by one or you can do a bulk delete. = 1.3.8 = * Fixed a problem with iterator in columns count. Thanks to alysko for their message: https://wordpress.org/support/topic/3rd-colums-ignored?replies=1 = 1.3.7 = * After upload, CSV file is deleted in order to prevent security issues. = 1.3.6 = * Thanks to idealien for telling us that we should check also if user exist using email (in addition to user login). Now we do this double check to prevent problems with users that exists but was registered using another user login. In the table we show this difference, the login is not changed, but all the rest of data is updated. = 1.3.5 = * Bug in image fixed * Title changed = 1.3.4 = * Warning with sends_mail parameter fixed * Button to donate included = 1.3.3 = * Screenshot updated, now it has the correct format. Thank to gmsb for telling us the problem with screenshout outdated = 1.3.2 = * Thanks to @jRausell for solving a bug with a count and an array = 1.3.1 = * WooCommerce fields integration into profile * Duplicate fields detection into profile * Thanks to @derwentx to give us the code to make possible to include this new features = 1.3 = * This is the biggest update in the history of this plugin: mails and passwords generation have been added. * Thanks to @jRausell to give us code to start with mail sending functionality. We have improved it and now it is available for everyone. * Mails are customizable and you can choose * Passwords are also generated, please read carefully the documentation in order to avoid passwords lost in user updates. = 1.2.3 = * Extra format check done at the start of each row. = 1.2.2 = * Thanks to twmoore3rd we have created a system to detect email collisions, username collision are not detected because plugin update metadata in this case = 1.2.1 = * Thanks to Graham May we have fixed a problem when meta keys have a blank space and also we have improved plugin security using filter_input() and filter_input_array() functions instead of $_POSTs = 1.2 = * From this version, plugin can both insert new users and update new ones. Thanks to Nick Gallop from Weston Graphics. = 1.1.8 = * Donation button added. = 1.1.7 = * Fixed problems with \n, \r and \n\r inside CSV fields. Thanks to Ted Stresen-Reuter for his help. We have changed our way to parse CSV files, now we use SplFileObject and we can solve this problem. = 1.1.6 = * You can import now user_registered but always in the correct format Y-m-d H:i:s = 1.1.5 = * Now plugins is only shown to admins. Thanks to flegmatiq and his message https://wordpress.org/support/topic/the-plugin-name-apears-in-dashboard-menu-of-non-aministrators?replies=1#post-6126743 = 1.1.4 = * Problem solved appeared in 1.1.3: sometimes array was not correctly managed. = 1.1.3 = * As fgetscsv() have problems with non UTF8 characters we changed it and now we had problems with commas inside fields, so we have rewritten it using str_getcsv() and declaring the function in case your current PHP version doesn't support it. = 1.1.2 = * fgetscsv() have problems with non UTF8 characters, so we have changed it for fgetcsv() thanks to a hebrew user who had problems. = 1.1.1 = * Some bugs found and solved managing custom columns after 1.1.0 upgrade. * If you have problems/bugs about custom headers, you should deactivate the plugin and then activate it and upload a CSV file with the correct headers again in order to solve some problems. = 1.1.0 = * WordPress user profile default info is now saved correctly, the new fields are: "user_nicename", "user_url", "display_name", "nickname", "first_name", "last_name", "description", "jabber", "aim" and "yim" * New CSV example created. * Documentation adapted to new functionality. = 1.0.9 = * Bug with some UTF-8 strings, fixed. = 1.0.8 = * The list of roles is generated reading all the roles avaible in the system, instead of being the default always. = 1.0.7 = * Issue: admin/super_admin change role when file is too large. Two checks done to avoid it. = 1.0.6 = * Issue: Problems detecting extension solved (array('csv' => 'text/csv') added) = 1.0.5 = * Issue: Existing users role change, fixed = 1.0.0 = * First release == Upgrade Notice == = 1.0 = * First installation == Frequently Asked Questions == = Can I import users from an Excel or LibreOffice file? = The plugin natively supports CSV files. If you need to import directly from Excel (XLSX, XLS) or LibreOffice (ODS) files without converting them first, the [File Formats Addon](https://import-wp.com/plugins/file-formats-addon/) adds support for those formats. = What format should my CSV file be? = You should fill the first two columns with the next values: Username, Email. The next columns are totally customizable and you can use whatever you want. All rows must contains same columns. User profile will be adapted to the kind of data you have selected. If you want to disable the extra profile information, please deactivate this plugin after make the import. = Can I import users by their WordPress ID? = You can use a column called id in order to make inserts or updates of an user using the ID used by WordPress in the wp_users table. We have two different cases: * If id doesn't exist in your users table: WordPress core does not allow us insert it, so it will throw an error of kind: invalid_user_id * If id exists: plugin check if username is the same, if yes, it will update the data, if not, it ignores the cell to avoid problems = Passwords = We can use a column called "Password" to manage a string that contains user passwords. We have different options for this case: * If you don't create a column for passwords: passwords will be generated automatically * If you create a column for passwords: if cell is empty, password won't be updated; if cell has a value, it will be used = Serialized data = Plugin can import serialized data. You have to use the serialized string directly in the CSV cell in order the plugin will be able to understand it as an serialized data instead as any other string. = Lists = Plugin can import lists as an array. Use this separator: :: two colons, inside the cell in order to split the string in a list of items. = WordPress default profile data = You can use those labels if you want to set data adapted to the WordPress default user columns (the ones who use the function wp_update_user) * user_nicename: A string that contains a URL-friendly name for the user. The default is the user's username. * user_url: A string containing the user's URL for the user's web site. * display_name: A string that will be shown on the site. Defaults to user's username. It is likely that you will want to change this, for both appearance and security through * obscurity (that is if you don't use and delete the default admin user). * nickname: The user's nickname, defaults to the user's username. * first_name: The user's first name. * last_name: The user's last name. * description: A string containing content about the user. * jabber: User's Jabber account. * aim: User's AOL IM account. * yim: User's Yahoo IM account. * user_registered: Using the WordPress format for this kind of data Y-m-d H:i:s. = Multiple imports = You can upload as many files as you want, but all must have the same columns. If you upload another file, the columns will change to the form of last file uploaded. = Export = You can export a file with all your users data using "Export" tab. There you will be able to find some filters and options to prepare your export. = Hooks: actions and filter = If you want to extend this plugin or use this plugin with any other, [here you have a list with all hooks available in the plugin](https://codection.com/import-users-csv-meta/listado-de-hooks-de-import-and-exports-users-and-customers/). = This plugin saved me a lot of time and work. Where can I donate? = Thanks, donations help us to continue improving our plugins and allow us to give the best support in the forums [Donate Here via PayPal.](https://codection.com/go/donate-import-users-from-csv-with-meta/) = I'm not sure I will be able to import all users with correct data and roles. Will you do it for me? = Of course! In Codection we help you to import, migrate, synchronized, update or any other operation you will need to do with your users. Contact us at contacto@codection.com for more information. = Free and premium support = You can get: * Free support [in WordPress forums](https://wordpress.org/support/plugin/import-users-from-csv-with-meta) * Premium support [writing directly to contacto@codection.com](mailto:contacto@codection.com). = Customizations, addons, develops... = [Write us directly to contacto@codection.com](mailto:contacto@codection.com). = Can I migrate users from another WordPress site? = Yes. Export users from your old site using the Export tab, then import the resulting CSV into your new site. Hashed passwords can be transferred using the user_pass column so users keep their existing passwords without needing to reset them. = Can I bulk create WooCommerce customers? = Yes. Add WooCommerce billing and shipping fields as columns in your CSV (e.g. billing_first_name, billing_email, shipping_address_1) and the plugin will populate them automatically when importing users with the customer role. = Can I import users with custom fields (ACF, BuddyPress, etc.)? = Yes. The plugin has addons for Advanced Custom Fields, BuddyPress/BuddyBoss, Paid Membership Pro, WooCommerce Memberships, WooCommerce Subscriptions and many others. Custom meta fields not covered by an addon can still be imported by using the meta key as the column header. = Can I import users without an email address? = By default WordPress requires an email for every user. If you need to import users without one, the [Allow No Email Addon](https://import-wp.com/plugins/allow-no-email-addon/) removes that requirement. = Can I update existing users without creating duplicates? = Yes. The plugin checks for existing users by username and email before inserting. If a match is found the user is updated instead of created. You can also control whether passwords and roles are overwritten on update. = Can I schedule automatic exports? = Scheduled exports are available via the [Recurring Export Addon](https://import-wp.com/plugins/recurring-export-addon/). It lets you configure periodic CSV exports of your users or WooCommerce customers and send them to a file path or remote destination automatically. = Can I schedule automatic imports? = Yes. The Recurring Import tab lets you configure a periodic import from a file path or URL. The plugin will fetch and process the CSV automatically at the chosen interval (hourly, daily, weekly, etc.) without any manual action. The import runs as the user selected in "User that runs the cron", so it can only do what that user is allowed to do. If the settings are saved by a user who cannot edit other users (`edit_users`), for example a role that has only been given `create_users` to import users, the import always runs as that same user, whoever starts it, and the selector only offers their own account. The free version supports one recurring import task. If you need multiple simultaneous scheduled imports — each with its own file, interval, role and settings — the [Recurring Import Addon](https://import-wp.com/plugins/recurring-import-addon/) removes that limitation. = Can I sync users from an external system or CRM? = Yes. Point the recurring import at a URL that your external system generates and the plugin will pull and process it on every scheduled run, keeping your WordPress users in sync automatically. = How can I report security bugs? = You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. [Report a security vulnerability.](https://patchstack.com/database/vdp/import-users-from-csv-with-meta) == Installation == ### **Installation** * Install **Import and export users and customers** automatically through the WordPress Dashboard or by uploading the ZIP file in the _plugins_ directory. * Then, after the package is uploaded and extracted, click _Activate Plugin_. Now going through the points above, you should now see a new _Import users from CSV_ menu item under Tool menu in the sidebar of the admin panel, see figure below of how it looks like. If you get any error after following through the steps above please contact us through item support comments so we can get back to you with possible helps in installing the plugin and more. Please read documentation before start using this plugin. == Other plugins by Codection == * [RedSys Gateway for WooCommerce Pro](https://codection.com/producto/redsys-gateway-for-woocommerce) (premium) * [Ceca Gateway for WooCommerce Pro](https://codection.com/producto/ceca-gateway-for-woocommerce-pro/) (premium) * [RedSys Gateway for Contact Form 7](https://codection.com/producto/redsys-gateway-for-contact-form-7/) (premium) * [Ceca Gateway for Contact Form 7](https://codection.com/producto/ceca-gateway-for-contact-form-7/) (premium) * [RedSys & Bizum Gateway for Gravity Forms](https://codection.com/plugin/redsys-bizum-gateway-for-gravity-forms/) (premium) * [RedSys & Bizum Gateway for WPForms](https://codection.com/plugin/redsys-gateway-for-wpforms/) (premium) * [RedSys & Bizum for GiveWP](https://codection.com/plugin/redsys-bizum-for-givewp/) (premium) * [RedSys Link Generator](https://codection.com/plugin/redsys-link-generator/) (premium) * [RedSys & Bizum Gateway for EDD Pro](https://codection.com/plugin/redsys-gateway-for-edd-pro/) (premium) * [RedSys Gateway for WP Booking Calendar Pro](https://codection.com/producto/redsys-gateway-for-wp-booking-calendar-pro/) (premium) * [Clean Login](https://wordpress.org/plugins/clean-login/) (free) * [Products Restricted Users for WooCommerce](https://wordpress.org/plugins/woo-products-restricted-users/) (free) * [First payment date for WooCommerce Subscriptions](https://wordpress.org/plugins/first-payment-date-for-woocommerce-subscriptions/) (free) * [Payment Schedule for WooCommerce Subscriptions](https://import-wp.com/payment-schedule-for-woocommerce-subscriptions) (premium)