An authenticated privilege escalation vulnerability in the Import and export users and customers WordPress plugin allows low-privileged users to elevate their accounts to administrator status.

This vulnerability involves improper privilege management (CWE-269) within the plugin front-end import functionality. An attacker with existing create_users capability can bypass required promote_users checks to modify user roles, including unauthorized elevation to administrator.

The ability for a restricted user to promote themselves or others to administrator level represents a complete compromise of the WordPress application. This provides attackers with full control over site content, user data, and configuration, likely leading to total system takeover or persistent backdoor installation. Given the CVSS score of 7.2, this high-severity flaw poses a significant risk to the integrity and confidentiality of the entire managed environment.

Immediate Action: Update the Import and export users and customers plugin to version 2.5.2 or later immediately.

Proactive Monitoring: Monitor WordPress user management logs for unexpected role changes or the creation of new administrator accounts.

Compensating Controls: If immediate patching is not feasible, temporarily deactivate the plugin and audit all current user roles for unauthorized administrative privileges.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing this plugin must prioritize the update to version 2.5.2 to eliminate the underlying privilege management flaw. Failure to patch allows any user with the create_users capability to achieve full administrative control, rendering other security layers moot. Apply this update across all affected WordPress instances as part of the next maintenance cycle.