A high severity privilege escalation vulnerability in the WP Import Export Lite plugin allows authenticated users with limited permissions to create administrator accounts and modify existing user roles.

This flaw exists due to improper privilege management (CWE-269), where the plugin fails to verify that a user performing an import action has the required administrative capabilities. An attacker with delegated, non-administrative access can leverage this to create new administrator accounts or overwrite existing ones.

The ability for a low-privileged user to gain full administrative control over a WordPress site presents a critical security risk. Successful exploitation could lead to total site compromise, including unauthorized data access, the installation of malicious software, and complete system takeover, which justifies the CVSS score of 7.2.

Immediate Action: Update the WP Import Export Lite plugin to version 3.9.35 or later immediately to apply the necessary capability checks.

Proactive Monitoring: Review WordPress user account creation logs and audit all administrative role assignments for unauthorized or unexpected changes.

Compensating Controls: If an immediate update is not feasible, restrict access to the plugin import functionality for all non-administrative users via role management plugins or configuration.

Public Exploit Available: exploit_available (false).

Given the potential for full site takeover, organizations using the WP Import Export Lite plugin must prioritize this update. Ensure that all users with access to this plugin are audited and that the software is updated to version 3.9.35 to remediate the privilege management flaw.