What is the CVSS score of CVE-2026-3629?

CVE-2026-3629 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3629?

A critical privilege escalation vulnerability in the WordPress Import and Export Users plugin allows unauthenticated attackers to gain full Administrator access to affected websites.

How to fix or mitigate CVE-2026-3629?

Within 24 hours: Audit all WordPress installations to identify active use of the Import and Export Users plugin and verify if the 'Show fields in profile' setting is enabled; immediately disable the plugin if in use. Within 7 days: If the plugin is business-critical, implement compensating controls (WAF rules blocking suspicious CSV imports, network segmentation) and engage the plugin vendor for security patches or workarounds. Within 30 days: Evaluate alternative plugins or custom solutions that do not have this vulnerability; maintain disable status until a security patch is officially released and verified.

WordPress CVE-2026-3629

EUVD-2026-14256 HIGH

Improper Privilege Management (CWE-269)

2026-03-21 Wordfence

GHSA-974q-2m48-3288

WordPress Privilege Escalation

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 22:45 euvd

EUVD-2026-14256

Analysis Generated

Mar 21, 2026 - 22:45 vuln.today

CVE Published

Mar 21, 2026 - 22:24 nvd

HIGH 8.1

DescriptionCVE.org

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.

AnalysisAI

The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows unauthenticated attackers to gain Administrator privileges. All versions up to and including 1.29.7 are affected. The vulnerability can only be exploited when specific configuration conditions are met (the 'Show fields in profile' setting is enabled and a CSV with wp_capabilities column has been previously imported), which increases attack complexity but does not eliminate the critical risk.

Technical ContextAI

This vulnerability (CWE-269: Improper Privilege Management) affects the Import and export users and customers WordPress plugin (CPE: cpe:2.3:a:carazo:import_and_export_users_and_customers). The root cause lies in the 'save_extra_user_profile_fields' function which fails to properly validate and restrict which user meta keys can be modified through profile fields during user registration. The 'get_restricted_fields' method does not include the critical 'wp_capabilities' meta key in its blocklist, allowing attackers to directly manipulate WordPress role assignments. The wp_capabilities meta key is fundamental to WordPress's privilege system, storing user role and capability information. By allowing arbitrary modification of this field, the plugin bypasses WordPress's built-in authorization controls. The vulnerability is evidenced in the source code at columns.php lines 193 and 217, and helper.php line 146 in version 1.29.7.

RemediationAI

Site administrators should immediately upgrade to version 1.29.8 or later of the Import and export users and customers plugin, as indicated by the patch commit available at https://plugins.trac.wordpress.org/changeset/3483330/import-users-from-csv-with-meta. Until patching is completed, administrators should disable the 'Show fields in profile' setting in the plugin configuration to prevent exploitation, and conduct an audit of recent user registrations to identify any suspicious privilege escalations by reviewing user role assignments in the WordPress admin panel. Review CSV import history and ensure that wp_capabilities columns are removed from any stored CSV templates to prevent future exploitation even after patching. After upgrading, verify that the get_restricted_fields method properly blocks modification of sensitive meta keys including wp_capabilities.