Executive brief
A WordPress plugin used to manage user accounts fails to properly check permissions in its import tool, allowing staff with basic user creation privileges to promote themselves or others to administrator. An attacker with limited account permissions could bypass security controls to gain full administrative access to a WordPress site.
Technical details
The plugin's front-end import functionality does not enforce the promote_users capability, permitting users with only create_users capability to alter existing user roles including promotion to administrator. This is a privilege escalation vulnerability requiring an authenticated user with create_users permission; the vulnerability enables an attacker with limited permissions to gain unrestricted administrative access.
Affected products
- WP Admin Import and export users and customers before 2.5.2
Timeline
- 2026-09-18: disclosed: Published on WPScan
- 2026-09-20: patched: Fixed in version 2.5.2