Import And Export Users And Customers EUVD-2026-14256

Requires WordPress with 'Import and export users and customers' plugin versions up to 1.29.7 installed and activated. Unauthenticated attacker submits crafted user registration request to set 'wp_capabilities' meta key. No user interaction required.

This vulnerability presents a high-severity risk with a CVSS score of 8.1 (High) and vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The network attack vector (AV:N) means exploitation can occur remotely, and the lack of required privileges (PR:N) combined with no user interaction (UI:N) makes it particularly dangerous. However, the high attack complexity (AC:H) is significant—exploitation requires pre-existing configuration conditions: the 'Show fields in profile' setting must be enabled AND a CSV file containing a wp_capabilities column must have been previously imported. This substantially limits the attack surface compared to a straightforward privilege escalation. The technical impact is maximum (C:H/I:H/A:H), as successful exploitation grants full administrative control. While no EPSS score or KEV status is provided in the available data, the conditional nature of exploitation and the need for specific prior configuration suggests this is less likely to be widely exploited compared to unconditional vulnerabilities, though sites meeting the conditions face critical risk.

An unauthenticated attacker identifies a WordPress site using the vulnerable plugin version where the administrator has enabled the 'Show fields in profile' setting and previously imported users with a CSV containing a wp_capabilities column. The attacker crafts a malicious user registration request that includes the wp_capabilities field set to Administrator privileges (s:13:"administrator";). Upon successful registration, the attacker's account is created with full administrative access to the WordPress site, allowing complete site takeover including installation of malicious plugins, data exfiltration, defacement, or deployment of additional malware.