Executive brief
A WordPress plugin for importing and exporting user data fails to properly validate permissions when assigning administrator roles during CSV imports. An attacker with basic user creation privileges can exploit this to create new administrator accounts or promote themselves to administrator, gaining full control of the WordPress site.
Technical details
The plugin does not correctly enforce the promote_users capability when assigning roles during CSV import operations, allowing users with only the create_users capability to bypass authorization checks. The vulnerability is triggered during the CSV import process where role assignment is performed without proper permission validation. A user with lower privileges can create new accounts with administrator role or escalate existing accounts, gaining unauthorized administrative access to the WordPress installation.
Affected products
- DynamiApps Import and export users and customers before 2.5.2
Timeline
- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 2.5.2