Description

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-19T07:16:32.540Z",
  "pubdate": "2026-09-19T07:16:32.540Z",
  "executiveSummary": "The WP Import Export Lite WordPress plugin, in versions prior to 3.9.35, is susceptible to an authorization bypass vulnerability. This security flaw stems from insufficient access control validation during user import procedures.\nThe vulnerability allows an authenticated user, who has been granted specific plugin-level permissions but lacks administrative privileges, to perform unauthorized actions. Specifically, an attacker can create new administrative user accounts or modify the security parameters, credentials, and role assignments of existing administrative accounts.\nThis represents a critical security risk as it facilitates full site compromise through unauthorized account takeover or administrative account creation. Exploitation requires the attacker to hold an account with existing plugin-delegated permissions, which can be leveraged to bypass intended WordPress user management restrictions. The vulnerability impacts the integrity and availability of the WordPress site, granting an unauthorized party full administrative control over the underlying CMS environment.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) or a broken access control mechanism within the user import functionality of the WP Import Export Lite plugin. The plugin fails to verify the execution context against the current user's capability set when processing import files containing user data. Specifically, it does not validate that the user initiating an import request possesses the 'manage_options' or 'edit_users' capabilities required by WordPress core to perform user management tasks.\nDuring the import process, the plugin parses user data provided via import files—typically CSV, XML, or other supported formats. Because the plugin does not enforce authorization checks during the mapping and persistence phases of the user import, it permits any user authorized to use the plugin interface to execute administrative-level functions. The vulnerable component is the user mapping and data handling module responsible for processing user account creation and modification requests.\nThe attack flow follows a structured exploitation path: First, an attacker logs into the WordPress dashboard with an account that has been granted the plugin’s delegated import/export permissions. Second, the attacker prepares a malicious import file containing user metadata, including fields for usernames, emails, roles, and password hashes. Third, the attacker initiates the import process through the plugin's interface. Fourth, the server-side processing logic consumes the input file and fails to perform an authorization handshake, proceeding to inject new user records or update existing ones via WordPress core functions like wp_insert_user or wp_update_user.\nBy crafting a payload that sets the role field to 'administrator' for a newly created user or updates an existing administrative user's credentials, the attacker effectively gains full control over the site. This bypasses the standard 'edit_users' capability check that would normally prevent non-administrators from modifying user roles. The post-exploitation impact includes full site takeover, potential code execution via theme or plugin modification, and unauthorized access to sensitive customer or user data. This vulnerability is accessible as long as the user possesses valid credentials to reach the plugin's operational dashboard, necessitating no direct network-level access beyond standard application authentication."
}