Privilege Escalation in Import Users and Customers Plugin for WordPress

CVE-2026-7641

What is CVE-2026-7641?

The Import Users and Customers plugin for WordPress contains a vulnerability that allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to an Administrator role on any subsite within a WordPress Multisite network. This occurs due to an incomplete blocklist in the save_extra_user_profile_fields() function, which inadequately restricts certain capability meta keys applicable to subsites. If an administrator has previously imported a CSV file with multisite-prefixed capability headers and enabled the 'Show fields in profile?' option, it leads to exposure of these keys on the user profile page, allowing unauthorized privilege escalation through crafted profile updates.

References