EUVD-2026-85704
GHSA-42cf-ph32-46f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Subscriber-level user
-
DeliveryStore crafted display_name and nickname via profile page
-
ExploitAdmin runs export/re-import migration with role update on
-
ExecutionEscape mismatch merges cell into role column
-
PersistParser assigns administrator role
-
ImpactAttacker gains full site control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires an authenticated account at Subscriber level or above on the target WordPress site to store the crafted display_name and nickname profile values. Exploitation does NOT complete on its own: a site administrator must run the plugin's documented export-then-reimport migration workflow with BOTH 'Update existing users' and 'Update roles for existing users' set to 'yes'. It further depends on the plugin's default parsing behavior where the exporter uses fputcsv() with a NUL escape char while the importer uses SplFileObject::fgetcsv() with only a delimiter (defaulting to backslash escaping), and on the fixed export column layout placing display_name before and nickname after the role column. These operator-driven, non-default migration settings are the primary limiting factors on real-world exploitation. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) rates this High and technically the outcome - a Subscriber becoming Administrator - justifies C:H/I:H/A:H. However, the vector materially understates the real preconditions and overstates day-to-day exploitability: the description states exploitation 'requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".' That is a separate privileged party's action plus two non-default toggles, which contradicts the UI:N in the vector and argues for AC:H/UI:R rather than AC:L/UI:N. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation is not confirmed in the wild. Net: a genuine, high-impact privilege-escalation bug worth patching, but real-world risk is gated by an operator-driven migration event rather than being a one-shot remote takeover - treat as important-but-conditional rather than an actively-exploited emergency. |
| Exploit ScenarioDerived | A registered Subscriber edits their own WordPress profile, planting crafted values in the display_name and nickname fields (both saved by WordPress core) so that a backslash escape sequence will bleed the display_name cell into the role column during a later CSV parse. When a site administrator subsequently runs the plugin's documented export-then-reimport migration with 'Update existing users' and 'Update roles for existing users' enabled, the escape-character mismatch between fputcsv() and SplFileObject::fgetcsv() causes the attacker's row to parse with 'administrator' as its role, and import_user's add_role grants it. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
RemediationAI
Apply the upstream fix tracked in the plugin changeset https://plugins.trac.wordpress.org/changeset/3687349/import-users-from-csv-with-meta, which addresses the exporter/importer escape-character mismatch; because the provided data does not identify a released, tagged version containing that changeset, confirm on the plugin's WordPress.org page that the installed version is newer than 2.4.17 before considering the site fixed (patch status: upstream fix available via commit/changeset, released patched version not independently confirmed). Until an updated release is verified, avoid running the plugin's export-then-reimport migration entirely, and if migration must be performed, never enable 'Update roles for existing users' and 'Update existing users' simultaneously - leaving role updates disabled removes the escalation path because the crafted role value is only honored on the update-existing-users code path (trade-off: existing accounts keep stale display names and roles and must be corrected manually). Additional compensating controls: restrict or disable Subscriber self-registration and audit profile fields so unexpected backslashes or crafted display_name/nickname values are not introduced, and review user roles after any past migration to detect accounts that were silently promoted to Administrator. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0f3444-4c10-45ce-a00b-4ed6038b8846?source=cve for the vendor's guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CSV serialization/deserialization asymmetry (CWE-266, Incorrect Privilege Assignment) inside the WordPress plugin also published under the slug import-users-from-csv-with-meta. The exporter (classes/batch_exporter.php, around line 459) writes cells with PHP's fputcsv() using a NUL byte (\0) as the escape character, while the importer (classes/import.php, around lines 872-888 and 1356) reads the same file through SplFileObject::fgetcsv() supplying only a single delimiter argument, so PHP falls back to its default backslash escape character. Because the fixed export column layout places display_name immediately before the role column and nickname immediately after it (helper.php, around line 78), a value a user controls in those two profile fields - saved by WordPress core through the standard profile page - can be interpreted such that the display_name cell is merged into the role field and the column count is rebalanced by the nickname cell. The parsed row therefore reaches import_user()'s add_role() path with 'administrator' as the role for the attacker's own record. Affected product data is expressed as cpe:2.3:a:carazo:import_and_export_users_and_customers:*:*:*:*:*:*:*:*, i.e. every released version of the plugin line through the last vulnerable tag, 2.4.17; the code references in the advisory are pinned to that tag, confirming the vulnerable parsing logic at that revision.
Know when Import And Export Users And Customers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Subscriber login gives PR:L; success depends on an admin running the migration with two specific toggles, so UI:R and AC:H; full admin takeover yields C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields - saved by WordPress core via the standard profile page - such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".
Executive ViewAI
WordPress sites running the Import and Export Users and Customers plugin at versions up to and including 2.4.17 face a privilege-escalation risk in which an authenticated Subscriber-level user can become an Administrator if a site operator runs the plugin's export/reimport workflow with two non-default role-update settings enabled. This could enable unauthorized administrative control, data exposure, and site integrity damage, and leadership should prioritize inventory and mitigation because no vendor-released patch is identified at time of analysis and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; disable or remove the Import and Export Users and Customers plugin (versions up to and including 2.4.17) until fixed, and if it must remain, keep 'Update existing users' and 'Update roles for existing users' set to 'no' during export/reimport, restrict and audit administrator access, limit Subscriber-level account creation, and monitor for unexpected role changes or new administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an au
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up t
Exploit-DB