Import and export users and customers <= 2.5.5 - Authenticated (Custom+) Missing Authorization to User Role Removal via Import and Cron Settings
- ID
- WPSEC-2026-0387
- Plugin
- Import and export users and customers (import-users-from-csv-with-meta)
- Affected
- all versions before 2.5.6
- Remediation
- Update to 2.5.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Import and export users and customers on WPSec AttackSurface
- Fix released
- Published
Description
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of user roles in all versions up to, and including, 2.5.5. This is due to missing 'promote_users' capability checks when the importer removes the existing roles of updated users and when the Cron tab's 'Update roles for existing users?' and 'Change role of users that are not present in the CSV' options are saved. This makes it possible for authenticated users who have been granted the plugin's import capability ('create_users' by default) but not 'promote_users', such as a custom role, to remove all roles from existing non-administrator users, or to make the recurring import strip the roles of, or assign a previously configured role to, every non-administrator user that is not listed in the CSV file.
References
- https://wpsec.com/vuln/WPSEC-2026-0387/
- https://plugins.svn.wordpress.org/import-users-from-csv-with-meta/tags/2.5.6/
- https://wordpress.org/plugins/import-users-from-csv-with-meta/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS