A high-severity privilege escalation vulnerability in the Import and export users and customers plugin allows authenticated users to gain unauthorized administrative access.

This flaw, categorized under CWE-269 (Improper Privilege Management), occurs because the plugin fails to properly validate the promote_users capability during CSV imports. An attacker with existing create_users privileges can abuse this functionality to promote themselves or other users to the administrator role.

Successful exploitation of this vulnerability results in full administrative control over the affected WordPress installation. This allows an attacker to manipulate site content, exfiltrate sensitive user data, or deploy malicious code, leading to significant reputational damage and potential regulatory non-compliance. With a CVSS score of 7.2, the high risk to data integrity and system availability necessitates immediate remediation.

Immediate Action: Update the Import and export users and customers plugin to version 2.5.2 or later immediately to resolve the capability check bypass.

Proactive Monitoring: Review audit logs for suspicious account modifications or unexpected user role changes that occurred during bulk import processes.

Compensating Controls: Restrict access to the import functionality to trusted administrators only and consider using a Web Application Firewall to monitor for unauthorized requests targeting the plugin's import endpoints.

Public Exploit Available: No (exploit_available: false)

Given the potential for total system compromise, administrators should prioritize updating this plugin immediately. Organizations must ensure that any third-party plugins are kept at current versions and perform regular reviews of user permissions to limit the blast radius of similar privilege management vulnerabilities.