Import and export users and customers WordPress Plugin up to and including 1.15.5.11 allows CSV injection via a customer's profile.
codection import and export users and customers