What is the CVSS score of CVE-2026-7641?

CVE-2026-7641 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Import and export users and customers are affected by CVE-2026-7641?

The 'Import and export users and customers' WordPress plugin (versions ≤2.0.8) contains an authenticated privilege escalation vulnerability affecting WordPress Multisite deployments.

How to fix or mitigate CVE-2026-7641?

Within 24 hours: Confirm whether your WordPress installation uses the 'Import and export users and customers' plugin and identify affected versions (≤2.0.8); if running Multisite with this plugin, immediately audit recent user imports for multisite-prefixed capability headers (wp_2_capabilities, wp_3_capabilities format). Within 7 days: Update to plugin version 2.0.9 or later per WordPress plugin repository changeset 3515646; review user permission changes in the past 90 days for unauthorized privilege escalations. Within 30 days: Conduct full Subscriber-to-Administrator privilege escalation audit across all subsites; disable the 'Show fields in profile?' option for the plugin if not operationally required; implement CSV import validation controls and audit logging.

Import and export users and customers CVE-2026-7641

EUVD-2026-26740 HIGH

Improper Privilege Management (CWE-269)

2026-05-02 security@wordfence.com

Privilege Escalation WordPress PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26740

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

HIGH 8.8

DescriptionCVE.org

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the save_extra_user_profile_fields() function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., wp_capabilities, wp_user_level) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., wp_2_capabilities, wp_2_user_level), allowing these keys to pass the in_array() check and be written directly to user meta via update_user_meta(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to /wp-admin/profile.php. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the acui_columns option and exposed as editable fields on the user profile page.

AnalysisAI

Authenticated privilege escalation in 'Import and export users and customers' WordPress plugin versions up to 2.0.8 allows Subscriber-level users to elevate privileges to Administrator on any subsite within a WordPress Multisite network. The vulnerability stems from an incomplete blocklist in save_extra_user_profile_fields() that restricts primary site capability meta keys (wp_capabilities) but fails to block multisite-prefixed equivalents (wp_2_capabilities, wp_3_capabilities, etc.). Exploitation requires that an administrator has previously imported a CSV with multisite-prefixed capability headers and enabled the 'Show fields in profile?' option. Patch released in changeset 3515646 per WordPress plugin repository. No EPSS or KEV data available, indicating no widespread exploitation detected at time of analysis.

Technical ContextAI

WordPress Multisite uses prefixed meta keys to isolate user capabilities across subsites. While the primary site uses wp_capabilities and wp_user_level meta keys, subsites use numbered prefixes like wp_2_capabilities for site ID 2, wp_3_capabilities for site ID 3, etc. The plugin's save_extra_user_profile_fields() function implements a blocklist using in_array() checks to prevent direct manipulation of capability meta keys via update_user_meta(). However, this blocklist only includes the primary site keys, allowing attackers to bypass the protection by targeting multisite-prefixed keys. This is a CWE-269 (Improper Privilege Management) issue where insufficient input validation on user-controllable profile fields enables unauthorized modification of security-critical metadata. The vulnerability is specific to WordPress Multisite installations and requires the plugin's CSV import feature to have been used with capability column headers that match the multisite naming convention.

RemediationAI

Update the Import and export users and customers plugin to version 2.0.9 or later, which implements the fix detailed in WordPress plugin repository changeset 3515646 at https://plugins.trac.wordpress.org/changeset/3515646. The patch extends the blocklist validation to include multisite-prefixed capability meta keys beyond just the primary site keys. Until patching is complete, implement these compensating controls with awareness of their limitations: Disable the 'Show fields in profile?' option in the plugin settings for any CSV columns containing capability-related headers (this prevents the vulnerable code path from exposing capability fields in user profiles, but may impact legitimate user management workflows). Alternatively, restrict Subscriber-level account creation and monitor existing Subscriber accounts for unexpected privilege changes by auditing user_meta table entries for wp_*_capabilities keys (this is detective rather than preventive and requires ongoing monitoring overhead). For maximum security during the patch window, temporarily deactivate the plugin if CSV import functionality is not actively required (this eliminates the vulnerability but disrupts all plugin features). Review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1 for additional vendor guidance and indicators of compromise.