Import and export users and customers CVE-2026-7641

Exploitation requires WordPress Multisite installation (not single-site WordPress), the Import and export users and customers plugin versions up to 2.0.8 installed and active, and critically depends on prior administrator actions: an administrator must have imported a CSV file containing multisite-prefixed capability column headers such as wp_2_capabilities or wp_3_capabilities corresponding to actual subsite IDs in the network, and the administrator must have enabled the 'Show fields in profile?' option for those imported columns, which stores the field names in the acui_columns WordPress option and renders them as editable fields on user profile pages. The attacker must possess at minimum Subscriber-level authenticated access (PR:L) to access /wp-admin/profile.php. Limiting factors that reduce widespread risk: the vulnerability is NOT exploitable on default WordPress installations or single-site deployments, requires specific plugin configuration choices by administrators rather than default settings, and depends on the site having previously imported user data with capability headers rather than standard user metadata, making this a targeted risk for organizations actively using the plugin's CSV import feature for multisite user management rather than a universal WordPress threat.

The CVSS score of 8.8 (High) accurately reflects the severe impact but requires careful context. The attack vector is network-based with low complexity (AV:N/AC:L) and requires only low-level privileges (PR:L), making exploitation straightforward for any authenticated user. However, real-world exploitability is significantly constrained by multiple prerequisites: the site must be running WordPress Multisite, an administrator must have previously imported a CSV with multisite-prefixed capability headers, and the 'Show fields in profile?' option must be enabled for those fields. These conditions make this a configuration-dependent vulnerability rather than a default-state exploit. The absence of EPSS data and KEV listing suggests no widespread exploitation campaigns, likely because the specific prerequisites limit the attack surface to a subset of WordPress Multisite installations using this plugin with specific import configurations. For affected installations meeting all prerequisites, however, the risk is critical as Subscriber accounts (the lowest privilege level) can escalate to full Administrator access on subsites, enabling complete site takeover, data exfiltration, and lateral movement across the Multisite network. Organizations should prioritize patching if they use WordPress Multisite with this plugin and have imported user capability data via CSV.

An attacker with a Subscriber account on a WordPress Multisite network running the vulnerable plugin authenticates to the site and navigates to their profile page at /wp-admin/profile.php. The attacker observes that the administrator has previously imported users via CSV with multisite capability headers and enabled profile field visibility, causing fields like wp_2_capabilities to appear as editable inputs. The attacker crafts a POST request to profile.php updating their wp_2_capabilities meta key to administrator-level permissions, bypassing the incomplete blocklist since only wp_capabilities (without the numeric prefix) is blocked. Upon submission, update_user_meta() writes the malicious capability data directly to the database, immediately elevating the attacker to Administrator role on subsite ID 2, granting full control over that subsite's content, users, themes, and plugins.