The vulnerability resides in the Import and Export Users and Customers WordPress plugin, versions up to 2.4.17. During a round‑trip export and re‑import, the exporter writes CSV cells with a NUL byte as the escape character, while the importer parses the file using the default backslash escape character. Because the exporter places the display_name field directly before the role column and the nickname field immediately after, an attacker can store crafted input in these two profile fields. When the CSV is parsed, the mismatch merges the display_name cell into the role column and realigns the remaining columns via the nickname field. This manipulation causes the importer to assign the Administrator role to the attacker’s own user record during the import_user routine, effectively elevating a Subscriber‑level user to Administrator. The flaw requires only that a site administrator allows the documented export‑reimport migration to run with both “Update existing users” and “Update roles for existing users” enabled.

WordPress installations running the Import and Export Users and Customers plugin, any version 2.4.17 or older. The flaw is exploitable on sites where the plugin is active and where users with Subscriber‑level roles can initiate the export/import process triggered by an administrator. All affected installations are vulnerable regardless of other configuration settings due to the inherent CSV parsing mismatch.

The flaw carries a CVSS score of 8.8, marking it as a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Nonetheless, the attack is feasible for any authenticated user with Subscriber privileges once an administrator performs the export/import migration. Because the vulnerability requires legitimate plugin functionality, exploitation is confined to sites that use the plugin and follow the default export‑import workflow. The potential impact is complete privilege escalation to administrator, compromising all site functions, data, and security controls. This high impact, coupled with the straightforward exploit path, renders the risk severe for affected WordPress deployments.