EUVD-2026-93081
GHSA-vhhj-fj85-qr7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Editor-level user
-
DeliveryAccess plugin import/export function
-
ExploitAbuse incorrect privilege assignment
-
ExecutionElevate account to administrator
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires an authenticated session with high privileges (PR:H) - specifically a WordPress Editor-level account on a site running the Import and export users and customers plugin version 2.5.5 or earlier. The attacker must be able to reach and invoke the plugin's user import/export feature, which is the vulnerable surface permitting an Editor to assign a higher (administrator) role. The principal limiting factors are: the need for a pre-existing Editor (or comparable high-privilege) account, the plugin being installed and active, and a multi-user site configuration where such accounts are held by less-trusted parties; no end-user interaction is required once the privileged session exists. |
| Impact | This is a genuine but conditional risk rather than a broad internet-facing emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 7.2 High) describes a network-reachable, low-complexity attack with NO user interaction, but critically requires HIGH privileges (PR:H) - consistent with the description's framing as 'Editor Privilege Escalation,' meaning an already-authenticated high-privilege user (e.g. an Editor) abuses the plugin to gain full administrator/site control (C:H/I:H/A:H, CWE-266 Incorrect Privilege Assignment). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore limited to multi-user WordPress sites where lower-trust Editor accounts exist and could be hijacked or are held by semi-trusted users - the barrier is not network reachability but obtaining or already possessing an Editor-level account. The 7.2 score is driven largely by the total CIA impact; the PR:H requirement is the dominant mitigating factor and should temper prioritization relative to an equivalent unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who already controls or has compromised a WordPress Editor-level account on a site running Import and export users and customers <= 2.5.5 invokes the plugin's user import/export functionality with crafted data to assign themselves (or a controlled account) the administrator role. This yields full control of the site, including arbitrary content, plugin, and user management. No public proof-of-concept was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
RemediationAI
No vendor-released patch version is identified in the available data; the only reference is the Patchstack advisory for the 2.5.5 privilege escalation (https://patchstack.com/database/wordpress/plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-2-5-5-privilege-escalation-vulnerability?_s_id=cve), so the first step is to check the plugin's WordPress.org changelog and that advisory for a fixed release above 2.5.5 and, if one exists, update to it immediately in staging first to confirm no import/export workflow breaks. If no fixed version is available, the most reliable compensating control is to deactivate and remove the plugin entirely, since the vulnerable import surface is its core function and disabling it removes the exposure at the cost of losing CSV-based user migration until a safe alternative (WP-CLI, core user import, or a maintained plugin) is adopted. Where removal is not operationally feasible, strip the plugin's import/export capabilities from the Editor role using a role-editing plugin or a small mu-plugin that removes the relevant capability, accepting that legitimate bulk user imports will then have to be performed by an administrator account with create_users and promote_users; note this only helps if the plugin itself honors capability checks elsewhere, so test any custom restriction carefully. Additionally, review the site's role hygiene: replace Editor accounts held by untrusted or external users with Author or Contributor roles (trade-off: reduced editorial workflow for those users), audit wp_users and wp_usermeta for administrator accounts created since the plugin was installed, reset credentials on any anomalous admin accounts, and log or alert on unexpected promote_users activity. Restricting access to the plugin's admin pages by IP through a WAF or web server rule can reduce exposure but will not stop an already-authenticated Editor from reaching the endpoint from an allowed network, so it should be treated as defense in depth rather than a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WordPress plugin Import and Export Users and Customers (slug import-users-from-csv-with-meta), published by Javier Carazo, tracked under CPE cpe:2.3:a:javier_carazo:import_and_export_users_and_customers. WordPress enforces authorization through a capability and role system in which Editors are intended to manage content but not create users or grant roles; administrator creation and role assignment are reserved for users holding create_users, promote_users, and related capabilities. The plugin exposes a CSV-based user import/export admin workflow that, in versions up to and including 2.5.5, does not adequately enforce those capability and role-assignment boundaries, so a caller who holds only Editor privileges can have arbitrary role values applied to an imported account. This maps to CWE-266 (Incorrect Privilege Assignment), with the underlying defect being a missing or insufficient authorization check on a privileged administrative operation rather than a memory-safety or injection bug. The CVSS vector confirms network reachability with low attack complexity and high confidentiality, integrity, and availability impact, but with PR:H indicating the attacker must already hold a privileged session; scope is unchanged, meaning the escalation stays within the WordPress instance and its user base. The EUVD record (EUVD-2026-93081) lists all versions of the plugin at or below 2.5.5 as affected, and the sole reference is the Patchstack vulnerability database entry for the 2.5.5 privilege escalation.
Know when Import And Export Users And Customers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack is over the WordPress HTTP interface (AV:N) with no interaction, but requires an existing Editor-level account, so PR:H; successful escalation to admin yields full C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Executive ViewAI
WordPress sites running the Import and Export Users and Customers plugin through version 2.5.5 face a privilege-escalation risk that can turn an existing Editor account into full administrator control. This is most consequential for multi-author, multi-tenant, or delegated publishing environments where Editor rights are granted to less-trusted users, because one compromised or malicious Editor can take over site administration. Leadership should care because site takeover can lead to content manipulation, data exposure, malicious plugin installation, and damage to customer trust, even though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Import and Export Users and Customers plugin (versions through 2.5.5) where not essential; restrict Editor accounts to trusted users and enforce least privilege and MFA; disable or tightly control the plugin's user import/export functionality and role-assignment capabilities; audit user role changes and administrator assignments in WordPress logs; and monitor vendor advisories for an update.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17)
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up t
Exploit-DB