WordPress security changelog
HIGH CVE-2026-86583 Deferred

User CSV export and re-import can promote a Subscriber to Administrator

A Subscriber or higher can save crafted display_name and nickname profile fields that straddle the exported role column. The exporter uses a NUL escape character in fputcsv(), but SplFileObject::fgetcsv() imports with the default backslash escape, shifting cell boundaries so import_user() applies an Administrator role via add_role(). Exploitation requires an administrator to export and re-import the file with both Update existing users and Update roles for existing users enabled; merely editing a profile does not grant privileges. Affected versions: <= 2.4.17. Confirmed fixed release: 2.4.18.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Import and export users and customers
Plugin slug
import-users-from-csv-with-meta
Affected
<= 2.4.17
Safe version
2.4.18
Published
Sep 23, 2026
Weakness
CWE-266 — Incorrect Privilege Assignment

This CVE was published Sep 23, 2026 and is one of 21 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to 2.4.18 or later, preferably the current supported release. Use identical explicit CSV escape rules for export and import, validate the parsed column schema, and enforce role-assignment capabilities independently of CSV content. Suspend role-updating re-imports until patched and review unexpected Administrator grants. The official changelog matches this vulnerability in 2.4.18. Official changelog: https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources