The Import and export users and customers WordPress plugin before version 2.5.2 fails to enforce the promote_users capability when processing a front‑end import. Users that have the create_users capability can modify the role field of existing accounts, including promoting them to administrator. This flaw enables a low‑privileged user to gain full administrative control over the WordPress site. The weakness is identified as CWE‑269, a privilege escalation vulnerability.

WordPress sites that have installed the Import and export users and customers plugin any version earlier than 2.5.2. The vulnerability is present in all affected versions regardless of other plugin or theme configurations.

Because the plugin’s front‑end importer is exposed to authenticated users with create_users access, a threat actor only needs to gain or already possess that capability to exploit the flaw. The CVSS score of 7.2 indicates a high severity, while the EPSS score of <1% suggests a low probability of exploitation. This vulnerability constitutes a high‑impact privilege escalation that can grant an adversary full administrative control. The vulnerability is not listed in the CISA KEV catalog, so known exploitation in the wild has not yet been reported, but the attack vector is straightforward and could be automated if the create_users capability can be acquired.