We've recently published an update for WP All Import (3.9.0), WP All Import Pro (4.11.0), and WP All Export Pro (1.9.8) migrating from PHPExcel to PHPSpreadsheet. The free version of WP All Export does not use PHPExcel.
These libraries are used simply to convert Excel files to CSV files so that they can be imported, and in WP All Export it generates . The maintainers of PHPExcel abandoned the project many years ago and moved to PHPSpreadsheet. However, at the time, migrating to PHPSpreadsheet would have broken all imports that use Excel files. So, we maintained an internal fork of PHPExcel and fixed any bugs and incompatibilities that cropped up.
Recently, the WordPress.org Plugin Repository Team asked us to migrate to PHPSpreadsheet, as there are several vulnerabilities reported for PHPExcel. These vulnerabilities generally aren't relevant to how we use PHPExcel in WP All Import or WP All Export Pro, and mostly would just allow someone to upload an Excel file with some special characters and access other files on the server, allowing you to hack your own WordPress site that you are already an administrator for. Of course, if a user can access WP All Import they can simply write PHP code in the Function Editor and do whatever they like. So, we don't feel you need to worry too much about these vulnerabilities in PHPExcel.
The Plugin Repository Team
To be perfectly clear, we completely support the WordPress.org Plugin Repository and their decision to ask us to migrate to PHPSpreadsheet. They are volunteers who work very hard and are under immense pressure by pretty much everyone. They are doing a fantastic job given their limited resources.
Potential Issues with Excel Imports
In our recent testing just before publishing these updates we actually didn't see any of the problems with Excel imports that we previously saw with WP All Import. That said, there might be problems with imports that we haven't been able to find, and if there are we will work as fast possible to address them, but you also may just have to recreate effected imports. We aren't sure, but again, in our tests we weren't able to find any problems. To be safe, if you have an import that uses Excel files, double check that everything is working.
We do not anticipate any issue with WP All Export.
If you do have a problem, get in touch via https://www.wpallimport.com/support/ and we'll do our best to help you out. You can also safely use previous versions of WP All Import that have PHPExcel, as long as you don't let import Excel files from people you do not trust. In fact, it's probably a good idea to not import files of any kind from people you don't trust, PHPExcel aside.
