The Import and export users and customers WordPress plugin versions prior to 2.5.2 fails to enforce the promote_users capability when processing a front‑end import. Users that possess the create_users capability can alter the user role field of existing accounts, including promoting any user to the administrator role. This vulnerability allows a low‑privileged user to gain full administrative control over the site, compromising all confidential data, code, and configuration stored on the WordPress installation.

WordPress sites that have installed the Import and export users and customers plugin any version earlier than 2.5.2. The vulnerability is present in all affected versions regardless of other plugin or theme configurations.

Because the plugin’s front‑end importer is exposed to authenticated users with create_users access, a threat actor only needs to gain or already possess that capability to exploit the flaw. The absence of a CVSS score and EPSS data means the exact severity cannot be quantified from the supplied information, but the ability to promote to administrator constitutes a high‑impact privilege escalation. The vulnerability is not listed in the CISA KEV catalog, so known exploitation in the wild has not yet been reported, but the attack vector is straightforward and could be automated if the ability to create or gain the create_users capability is obtained.