This vulnerability in the Import and Export Users and Customers WordPress plugin allows an authenticated user with Subscriber-level access or higher to elevate their privileges to Administrator on any subsite within a Multisite network. The issue stems from an incomplete blocklist that fails to block multisite-prefixed capability meta keys such as wp_2_capabilities or wp_2_user_level during user profile updates. By submitting a crafted profile update to /wp-admin/profile.php, an attacker can write these keys to user meta via update_user_meta, thereby granting themselves administrative rights on the targeted subsite. This reflects a weakness in the use of authorization checks (CWE-269).

The affected product is the Import and Export Users and Customers plugin from vendor carazo, for WordPress sites. All plugin versions up to and including 2.0.8 are vulnerable. Users running a WordPress Multisite installation that has previously imported a CSV containing multisite-prefixed capability column headers and enabled the 'Show fields in profile?' option are at risk.

The CVSS score of 8.8 indicates a high severity impact with significant potential damage. While EPSS data is not available, the vulnerability requires prior admin action (importing a CSV with multisite capability columns) and a subscriber or higher user role, which may limit widespread exploitation but still pose a serious threat in environments where such conditions are likely. The issue is not listed in the CISA KEV catalog at present. Attackers would typically craft a malicious profile update payload and submit it through the user profile page, exploiting the missing capability checks on multisite meta keys.