A critical privilege escalation vulnerability in the Import and export users and customers plugin allows authenticated subscribers to achieve administrator access.

This is a privilege assignment flaw (CWE-266) where a mismatch between the exporter's NUL byte escape character and the importer's default backslash parser allows an authenticated attacker to manipulate user role data during the import process. The attacker must possess Subscriber-level access or higher and relies on a site administrator to execute the import workflow.

Successful exploitation grants an attacker full administrative control over the WordPress instance. This bypass of access controls leads to complete site compromise, including the ability to exfiltrate user data, modify site content, and execute arbitrary code via plugin or theme management, which justifies the high CVSS score of 8.8.

Immediate Action: There is no confirmed patch version provided in the source data: users should monitor the vendor repository for updates and disable the plugin functionality until a secure version is verified.

Proactive Monitoring: Security teams should monitor user role changes and audit logs for unexpected account elevation, particularly following any administrative import or migration tasks.

Compensating Controls: Restrict access to the plugin settings and export/import functionality to trusted administrative users only, and employ a Web Application Firewall to monitor for abnormal file upload or import requests.

Public Exploit Available: Unknown.

Given the severity of this privilege escalation, administrators must treat this vulnerability with high urgency. Immediately restrict the use of the Import and export users and customers plugin and maintain a strict audit of administrative actions until the vendor provides a verified patch.