Description

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-20T07:16:51.257Z",
  "pubdate": "2026-09-20T07:16:51.257Z",
  "executiveSummary": "The 'Import and export users and customers' WordPress plugin prior to version 2.5.2 contains a critical authorization bypass vulnerability due to incorrect capability enforcement during the CSV import process.\nThe vulnerability allows an attacker possessing the 'create_users' capability—typically assigned to roles with lower privileges than administrators—to perform unauthorized privilege escalation.\nBy manipulating the CSV import function, an attacker can create new administrator-level accounts or modify existing user roles to include the administrator role, effectively gaining full control over the WordPress instance.\nThis represents a severe security risk as it subverts the WordPress Role-Based Access Control (RBAC) model.\nExploitation requires the attacker to have at least 'create_users' capabilities and access to the plugin's import functionality.\nNo external network exposure is required, as the attack is performed through authenticated internal interfaces.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper verification of WordPress capabilities during the user import routine. The plugin fails to validate whether the current user possesses the 'promote_users' capability, which is the standard WordPress requirement for modifying or assigning higher-level roles to user accounts.\nInstead, the plugin relies on the 'create_users' capability during the CSV processing phase. In a default WordPress installation, 'create_users' is insufficient for administrative role management, but the plugin logic allows any user with this capability to define arbitrary roles for imported users.\nThe attack flow begins when an authenticated user with 'create_users' capability accesses the CSV import feature provided by the plugin. The attacker prepares a crafted CSV file where the 'role' column is set to 'administrator' for either new user entries or existing account identifiers.\nWhen the plugin processes this file, it parses the user data and invokes the underlying WordPress user update or creation functions. Because the plugin does not explicitly check for 'promote_users' before executing these functions, the user roles are updated according to the CSV parameters.\nEssentially, the vulnerability bypasses the intended security boundary defined by 'promote_users'. By supplying a maliciously crafted CSV, the attacker force-assigns the administrator role to an account under their control.\nThis occurs regardless of the attacker's actual authorization level, provided they meet the initial 'create_users' threshold. Post-exploitation impact is catastrophic, as the attacker achieves full administrative access to the WordPress environment, allowing for remote code execution, data exfiltration, and total site compromise.\nThe vulnerability is present in all versions of the 'Import and export users and customers' plugin prior to 2.5.2. Remediation requires strict adherence to the WordPress API capability checks, specifically requiring the implementation of 'current_user_can('promote_users')' before any user role assignment or modification is committed to the database during import operations."
}