Privilege Escalation in Import and Export Users Plugin for WordPress

CVE-2026-86583

What is CVE-2026-86583?

The Import and Export Users and Customers Plugin for WordPress is susceptible to a privilege escalation flaw. This vulnerability arises from a mismatch in the way data is exported and imported, allowing authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. By manipulating the export and re-import workflow, an attacker can craft specific values in user profile fields, leading to an unauthorized escalation of account privileges when the export is re-imported by an administrator with specific settings. It is essential for administrators using this plugin to be aware of this security risk and to ensure that their installations are updated to prevent exploitation.

References