WordPress Plugin Vulnerabilities

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

Description

The plugin does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

Proof of Concept

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 2.4.2

References

CVE
CVE-2026-16534

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
0d1246a0-3cd1-4b6d-bd3e-6ed89745da26

Timeline

Publicly Published
2026-07-23 (about 11 days ago)
Added
2026-07-23 (about 10 days ago)
Last Updated
2026-07-31 (about 2 days ago)

Other

Published
Title
Published
2025-03-06
Title
School Management System for Wordpress <= 93.0.0 - Student+ Account Takeover and Privilege Escalation
Published
2022-10-10
Title
Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation
Published
2016-04-05
Title
User Role Editor <= 4.24 - Privilege Escalation
Published
2020-05-13
Title
Site Kit by Google < 1.8.0 - Privilege Escalation to gain Search Console Access
Published
2020-01-16
Title
WP Database Reset < 3.15 - Privilege Escalation