Technical impact
The Import and export users and customers WordPress plugin fails to enforce correct permission checks when importing data from a CSV file. A user who has only the ability to create new users can use this flaw to generate an account with administrator privileges or overwrite the nickname, password, or email address of an existing administrator. This flaw allows an attacker to gain full control of the site, compromising confidentiality, integrity, and availability of all site data.
Affected Systems
All installations of the Import and export users and customers plugin before version 2.4.2 are susceptible. The vulnerability does not target specific WordPress versions beyond the plugin's version requirement, but any WordPress site running that plugin package is at risk.
Risk and Exploitability
The EPSS score is reported as < 1%, indicating a very low probability of exploitation, but the CVSS score of 9.1 reflects a severe impact. The vulnerability is not listed in CISA's KEV catalog, suggesting no widely known public exploits are currently documented. The most probable attack vector is a CSV import file submitted by an actor who already has user‑creation capability on the site. By crafting a CSV containing an administrator username and credentials, an attacker can create a privileged account or replace the details of an existing administrator. The vulnerability requires the attacker to be authenticated with a role that can create users, but once such a role is available, no additional exposure to the site’s network is needed for the exploit.
