Import and Export Users and Customers EUVD-2026-52166

Exploitation requires an authenticated WordPress account that holds the user-creation capability (create_users) and access to the plugin's CSV import function on a site running the plugin below version 2.4.2. The specific trigger is supplying attacker-chosen role and identity fields (e.g., role=administrator, or an existing admin's login with a new password/email) in the imported CSV, which the plugin applies without checking promote_users/edit_users permissions. Limiting factors: the actor must already possess the create_users capability, which in default WordPress installs is held only by administrators - the flaw becomes meaningful mainly where that capability has been delegated to a lower-privileged custom role; no user interaction from a victim and no non-standard platform are otherwise needed.

Signals are mixed but lean toward genuine priority for sites that expose the create_users capability to non-administrators. SSVC rates Exploitation as 'poc', Automatable 'yes', and Technical Impact 'total' - consistent with a straightforward, scriptable path to full admin takeover. The published CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) treats the attack as unauthenticated, but the description clearly states the actor must already hold the user-creation capability, which is an authenticated, capability-gated prerequisite; this is a material discrepancy - the real vector is more accurately PR:L, lowering the practical score to roughly 8.1. EPSS is low (0.13%, 3rd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of widespread or active exploitation - the risk is realistic-but-targeted rather than mass-exploited. Net: high impact and low complexity once the modest precondition is met, but the PR:N claim overstates exposure for default configurations where only administrators can create users.

An attacker who controls a WordPress account granted only the user-creation capability (for example a delegated shop or membership manager) crafts a CSV that assigns the 'administrator' role to a new user, or that targets an existing admin's username to reset its password/email, then submits it through the plugin's import screen. Because the plugin does not re-validate role-assignment or edit permissions, the CSV values are applied verbatim, handing the attacker administrator access. Publicly available exploit code lowers the skill barrier for reproducing this.