Description
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.
Published: 2026-03-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to Administrator
Action: Apply Patch
AI Analysis

Impact

The plugin fails to restrict which user meta keys can be updated via profile fields, allowing an attacker to set the wp_capabilities meta key and grant themselves Administrator privileges. This grants full control over the WordPress site, compromising confidentiality, integrity, and availability.

Affected Systems

WordPress sites using Import and export users and customers plugin version 1.29.7 or earlier, where the Show fields in profile setting is enabled and a CSV with a wp_capabilities column header has been previously imported, are affected.

Risk and Exploitability

The flaw carries a CVSS score of 8.1, indicating high severity. Exploitation requires that the target accepts CSV imports using the Show fields in profile setting and that an attacker submits a crafted registration request with wp_capabilities data. The vulnerability is not listed in the CISA KEV catalog and EPSS data is unavailable, yet the potential for granting full administrative control remains significant.

Generated by OpenCVE AI on March 21, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Import and export users and customers plugin to a version newer than 1.29.7.
  • If an update is not possible, disable the Show fields in profile setting to prevent the vulnerable write operation.
  • Remove any wp_capabilities entries from existing user meta or reimport the data without that column to eliminate elevated privileges that may already have been granted.

Generated by OpenCVE AI on March 21, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Carazo
Carazo import And Export Users And Customers
Wordpress
Wordpress wordpress
Vendors & Products Carazo
Carazo import And Export Users And Customers
Wordpress
Wordpress wordpress

Sat, 21 Mar 2026 22:45:00 +0000

Type Values Removed Values Added
Description The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.
Title Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Carazo Import And Export Users And Customers
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:50:18.319Z

Reserved: 2026-03-06T05:47:33.801Z

Link: CVE-2026-3629

cve-icon Vulnrichment

Updated: 2026-03-23T16:13:18.070Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-21T23:16:51.393

Modified: 2026-03-23T14:31:37.267

Link: CVE-2026-3629

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:46:58Z

Weaknesses