An authenticated privilege escalation vulnerability in the Import and export users and customers plugin for WordPress allows subscriber-level users to gain administrator privileges within multisite networks.

This flaw is classified as improper privilege management (CWE-269), arising from an incomplete blocklist in the save_extra_user_profile_fields() function. Authenticated attackers with subscriber-level access and above can exploit this flaw via crafted profile updates.

A successful exploitation of this vulnerability allows low-privileged users to escalate their privileges to administrator on any subsite within a WordPress Multisite network, leading to complete system compromise and total loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this high-severity flaw exposes organizational infrastructure to severe operational disruption and unauthorized administrative access.

Immediate Action: Update the Import and export users and customers plugin to the latest patched version once available, or temporarily deactivate the plugin if no fix is ready.

Proactive Monitoring: Monitor user account creation logs and profile modification requests for unusual privilege changes, particularly involving subscriber-to-administrator escalations on multisite installations.

Compensating Controls: Implement Web Application Firewall rules to inspect and block requests targeting user profile endpoints that attempt to submit unexpected capability meta keys.

Public Exploit Available: No — no confirmed public exploit is available in the provided data.

Given the high CVSS score and the severe impact of privilege escalation, administrators must treat this vulnerability with urgency. Review affected WordPress Multisite environments immediately, restrict user profile modifications, and apply vendor updates as soon as they are released to prevent unauthorized administrative access.