This vulnerability allows a user with the Subscriber role to gain privileges above those intended by the role. The flaw exists in the WordPress Import and export users and customers plugin versions 2.5.2 and earlier, permitting escalation to higher capabilities such as editing site settings or managing content. The weakness is classified as CWE‑266, indicating improper access control. Such an escalation can compromise the confidentiality, integrity, and availability of the site, and enable attackers to install additional malicious plugins or alter website content.

All WordPress installations using the Import and export users and customers plugin by Javier Carazo with versions 2.5.2 or earlier are affected. The plugin’s versioning indicates that upgrades to 2.5.4 or later contain the fix.

The CVSS score of 7.5 reflects high severity, and although EPSS data is unavailable, the absence from the KEV catalog suggests no publicly available exploits have been documented. The likely attack vector is local: an authenticated Subscriber must first log into the WordPress dashboard, making the risk conditionally dependent on user access. If an attacker can create a Subscriber account or gain access to an existing one, escalating privileges becomes trivial. Given the high impact and the fact that the fix already exists, the risk remains substantial until the plugin is updated.