Description

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-20T07:16:51.353Z",
  "pubdate": "2026-09-20T07:16:51.353Z",
  "executiveSummary": "The 'Import and export users and customers' WordPress plugin prior to version 2.5.2 contains a critical broken access control vulnerability. The flaw exists within the front-end user import functionality, which fails to properly validate the 'promote_users' capability during the execution of user role modification processes.\nThis vulnerability allows an authenticated user possessing only the 'create_users' capability—typically assigned to lower-privileged accounts such as Authors or Contributors—to manipulate the attributes of existing system users. By exploiting this oversight, a malicious actor can escalate their own privileges or those of another account to the 'administrator' role.\nThe implications of this vulnerability are severe, as it permits unauthorized administrative access to the WordPress environment. An attacker achieving this level of control can compromise the entire site, including the ability to execute arbitrary code, modify site content, exfiltrate sensitive database information, and install malicious plugins. Because the vulnerability is reachable through the front-end interface, the attack vector is significantly more accessible than backend-only exploits. No sophisticated bypasses are required; the flaw is a direct consequence of inadequate server-side permission checks.",
  "technicalDetails": "The vulnerability resides in the front-end user import module of the 'Import and export users and customers' plugin. The root cause is an insecure authorization check that erroneously relies on the 'create_users' capability to gate sensitive user management operations, rather than enforcing the 'promote_users' capability as required by the WordPress security model for modifying user roles.\nDuring the import process, the plugin parses user data provided via an uploaded file or input stream. The backend handler responsible for processing these imports executes role-update logic without verifying if the authenticated user has explicit permission to change the roles of existing records. Because the application logic fails to distinguish between the 'create' action and the 'promote' action, it implicitly grants users with 'create_users' privileges the authority to overwrite the roles of pre-existing accounts.\nThe attack flow begins when an authenticated attacker with 'create_users' access initiates the import process through the front-end interface. The attacker constructs a CSV or XML import file containing the target user ID and a modified role parameter set to 'administrator'. When the plugin processes this file, the vulnerable function performs a database update operation to alter the 'wp_capabilities' meta key for the specified user record. Since the function lacks the necessary capability check for role promotion, the update proceeds without obstruction.\nThe impact is a full privilege escalation. By updating the metadata associated with their own user account, the attacker essentially grants themselves administrative rights. Once the role is updated, the attacker gains full access to the WordPress dashboard, allowing for administrative actions such as installing arbitrary code through plugins or themes, modifying database contents, and escalating control over the entire server environment. This vulnerability is active on all versions of the plugin prior to 2.5.2 and is exposed via standard web protocols over HTTP/S. The exploitation does not require advanced knowledge of the server configuration, only the ability to interact with the plugin's front-end import functionality."
}