The Import and export users and customers plugin (versions <= 2.5.5) contains an improper authorization flaw that lets an authenticated user with Editor privileges increase their own capabilities. By exploiting the lack of role checks when performing import/export actions, an attacker can elevate from Editor to Administrator, granting full control over the WordPress site. This weak point is identified as CWE‑266, and it opens a path for unauthorized account takeover and complete site compromise.

Any WordPress site that has the Import and export users and customers plugin version 2.5.5 or earlier installed. The plugin is developed by Javier Carazo. Sites that use it for bulk user or customer import/export are directly exposed.

The CVSS score of 7.2 indicates a high severity rating. EPSS analysis shows a low exploitation probability (less than 1%), and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to own or compromise an Editor‑level account; once such credentials exist, the plugin’s missing authorization checks allow elevation to Administrator. The most likely attack vector is internal to the WordPress site, requiring legitimate site login credentials. Despite the low EPSS, the high severity and clear privilege‑escalation path make the risk to affected sites significant, warranting prompt remediation.