Export And Import Users And Customers
Monthly
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.