Import and export users and customers <= 2.5.6 - Authenticated (Custom+) Privilege Escalation via Account Takeover in Cron Import
- ID
- WPSEC-2026-0392
- Plugin
- Import and export users and customers (import-users-from-csv-with-meta)
- Affected
- all versions before 2.5.7
- Remediation
- Update to 2.5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Import and export users and customers on WPSec AttackSurface
- Fix released
- Published
Description
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.5.6. This is due to the recurring (Cron) import running with the privileges of the user selected in 'User that runs the cron', of the site's first administrator when no valid user is selected, or of whoever clicks 'Run now', instead of with the privileges of the user who configured the task. This makes it possible for authenticated attackers who have been granted the plugin's import capability ('create_users' by default) but not 'edit_users', such as a custom role or, on multisite networks that allow site administrators to add new users, a site administrator, to point the recurring import at their own CSV file and have it processed with the privileges of an administrator or super administrator. The import can then reset another administrator's password or change the email address of the account the import runs as, leading to full site takeover.
References
- https://wpsec.com/vuln/WPSEC-2026-0392/
- https://plugins.svn.wordpress.org/import-users-from-csv-with-meta/tags/2.5.7/
- https://wordpress.org/plugins/import-users-from-csv-with-meta/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS