The WordPress plugin Import and Export Users and Customers, in all versions preceding 2.5.2, fails to enforce the promote_users capability when assigning roles during a CSV import. As a result, any user that possesses only the create_users capability can create new administrator accounts or elevate existing users to the administrator role. This flaw directly enables an attacker with limited privileges to gain full administrative control of the WordPress site, compromising confidentiality, integrity, and availability.

All deployments of the Import and Export Users and Customers WordPress plugin running a version older than 2.5.2 are vulnerable. The vulnerability applies regardless of the hosting environment but requires that the vulnerable user has the create_users capability, which many sites grant to lower‑privileged roles such as editors or authors.

Based on the description, it is inferred that lower‑privileged roles such as editors or authors often have the create_users capability, giving many users the atomic permission to create or promote administrators. The likely attack vector is local to the plugin’s CSV import function; an attacker can craft a CSV file assigning the administrator role to a new or existing user and upload it through the import interface. Although no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, the ability to create or promote administrators represents a high‑impact exploit scenario. The risk is therefore significant, especially on sites with permissive role assignments. A patch that enforces proper capability checks would remove the risk entirely.