Import Export Users EUVD-2026-83678

Exploitation requires (1) an authenticated account holding the create_users capability but NOT promote_users - a delegated non-admin privilege - and (2) the plugin's front-end import functionality being reachable to that user. It does NOT require administrator access or user interaction from a victim. The limiting factor is that create_users is, by default on single-site WordPress, granted only to administrators; the vulnerability is materially exploitable only where a role/user-management configuration delegates create_users to lower-privileged roles. Sites running plugin version 2.5.2 or later are not affected.

This is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) scores 7.2 with C:H/I:H/A:H, reflecting that promoting a user to administrator yields total site control. A public exploit exists (WPScan) and a vendor patch (2.5.2) is available, so the window between disclosure and defensive action is short - a favorable signal for defenders but also a signal that opportunistic exploitation is feasible. No EPSS score or CISA KEV entry is provided, so there is no evidence of active in-the-wild exploitation; the correct read is 'publicly available exploit code exists' rather than confirmed exploitation. The main point of dispute is the vendor's PR:H rating: the vulnerability specifically empowers a user holding ONLY the create_users capability (a delegated, non-administrator privilege commonly granted by user-management setups) to escalate - so PR:L is more faithful than PR:H, which would push the base score to ~8.8. Net: a real priority in environments that delegate user-creation to sub-admin roles, and a lower-priority theoretical issue in single-admin sites where only administrators hold create_users.

A WordPress site delegates the create_users capability to a non-administrator role (e.g. a shop/customer manager or a custom user-management role). That user submits the plugin's front-end import with an existing user's login and a role field set to 'administrator'; because promote_users is never checked, the target - or the attacker's own account - is elevated to administrator, granting full site control. A public proof-of-concept from WPScan lowers the skill barrier to reproduce this.