A critical privilege escalation vulnerability in the Import and export users and customers WordPress plugin allows low-privileged users to gain full administrative control over the application.

The plugin fails to perform proper capability checks during CSV imports, enabling an attacker with minimal user-creation permissions to overwrite existing administrator accounts or create new ones. This represents a failure in Improper Privilege Management (CWE-269).

Successful exploitation grants an attacker full administrative access to the WordPress environment. This results in total compromise of site integrity, potential exfiltration of sensitive user data, and the ability to deploy malicious content, leading to severe reputational damage and operational disruption. The high CVSS score of 9.1 reflects the ease of exploitation and the critical nature of the impact.

Immediate Action: Update the Import and export users and customers plugin to version 2.4.2 or later immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected creation of administrative accounts or suspicious modifications to existing administrator profiles.

Compensating Controls: Disable the import functionality or restrict access to the plugin settings to trusted users only until the update is applied.

Public Exploit Available: Unknown.

Given the critical severity and the potential for full administrative takeover, organizations must prioritize patching this plugin immediately. If an immediate update is not feasible, the plugin should be deactivated to prevent unauthorized privilege escalation until the environment can be secured.