Import Export Users CVE-2026-94178

Requires an authenticated low-privileged WordPress account (PR:L - the description specifies a Subscriber), so the site must permit or already have subscriber-level users; sites with open user registration make this precondition trivial. Exploitation targets the 'Import and export users and customers' plugin (by Javier Carazo) at versions <= 2.5.2. The CVSS AC:H rating indicates a non-trivial precondition (timing, race, or specific state) rather than a single deterministic request, which LIMITS reliable exploitation. No user interaction is required (UI:N) and the vector is network-reachable (AV:N).

The single most authoritative signal here is the Patchstack-supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, scoring 7.5 (High). It describes an authenticated (PR:L, i.e. a Subscriber-level account) privilege-escalation flaw reachable over the network with no user interaction, but gated by high attack complexity (AC:H) - meaning some race, timing, or non-trivial precondition is needed rather than a trivial single request. The C:H/I:H/A:H triad is consistent with privilege escalation: a low-privileged subscriber gaining higher (potentially administrator-equivalent) rights would fully compromise the site. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The realistic priority is moderate: the flaw requires an existing authenticated account (PR:L) and non-trivial exploitation (AC:H), which lowers real-world urgency below what the 7.5 base score alone suggests, but on WordPress sites that allow open subscriber registration, obtaining PR:L is trivial, which raises effective risk. Sites should patch, prioritizing those with open registration enabled.

An attacker registers or already holds a low-privileged (Subscriber) account on a WordPress site running the 'Import and export users and customers' plugin at version 2.5.2 or earlier. By abusing the plugin's user import/update handling under specific conditions (reflected in the AC:H rating), the attacker manipulates their own role or metadata to escalate to a higher-privileged role such as administrator. No public exploit code was identified in the available data, and the high attack complexity implies non-default timing or precondition requirements.