Privilege Escalation in Import and export users and customers WordPress Plugin

The Import and export users and customers plugin for WordPress (versions 2.4.17 and earlier) contains a privilege escalation vulnerability (CVE-2026-86583). The vulnerability stems from an inconsistency in how the plugin handles CSV escaping. The exporter utilizes fputcsv() with a NUL byte (\0) as an escape character, while the importer utilizes SplFileObject::fgetcsv() with a default backslash escape character.

Because the CSV column layout places the 'display_name' field immediately before the 'role' field and the 'nickname' field immediately after, a malicious user can craft specific values in their profile settings. When an administrator triggers a site-wide user export and subsequent re-import with "Update existing users" and "Update roles for existing users" enabled, the CSV parser fails to correctly interpret the escape characters. This leads to cell merging, where the attacker's 'display_name' merges into the 'role' field and the 'nickname' rebalances the column count. Consequently, the user is assigned the 'administrator' role when the plugin processes the file.

Impact

Successful exploitation allows an authenticated user with subscriber-level access to escalate their account to administrator status. This grants the attacker full control over the affected WordPress site, enabling malicious code execution, data exfiltration, or total site takeover. This vulnerability affects any WordPress instance utilizing the vulnerable plugin version and requires the administrator to perform an export/import maintenance task.

Recommendation

• Upgrade the Import and export users and customers plugin to a version later than 2.4.17 immediately.
• Review WordPress user role assignments for unexpected administrators, specifically those who were previously subscribers or customers.
• Disable the plugin's "Update roles for existing users" feature if an update is not immediately feasible to prevent automatic role elevation during imports.
• Audit recent CSV import logs for the Import and export users and customers plugin to identify potential exploitation attempts.