CVE-2026-3629 - Vulnerability Analysis

Overview

WordPress Import and export users and customers plugin <= 1.29.7 contains a privilege escalation caused by improper restriction of user meta keys in 'save_extra_user_profile_fields', letting unauthenticated attackers escalate privileges to Administrator via crafted registration, exploit requires 'Show fields in profile' enabled and prior CSV import with wp_capabilities column.

Severity & Score

Impact

Unauthenticated attackers can escalate privileges to Administrator, compromising site control and security.

Mitigation

Update to the latest version beyond 1.29.7.

References

• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/helper.php#L146
• https://plugins.trac.wordpress.org/changeset/3483330/import-users-from-csv-with-meta#file37
• https://www.wordfence.com/threat-intel/vulnerabilities/id/48dd9098-38e6-49da-8d22-27e12fddef51?source=cve
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/columns.php#L193
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/columns.php#L217

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner