CPE
An escape character mismatch between CSV export and import functions in the Import and export users and customers WordPress plugin allows authenticated users to escalate privileges to administrator.