CVE-2026-7641 - Vulnerability Analysis

Overview

WordPress Import and export users and customers plugin <= 2.0.8 contains a privilege escalation caused by incomplete blocklist of capability meta keys in multisite networks in save_extra_user_profile_fields(), letting authenticated subscribers escalate to administrators on subsites, exploit requires prior CSV import with multisite-prefixed capability headers and enabled profile field display.

Severity & Score

Impact

Authenticated subscribers can escalate privileges to administrator on any subsite in a multisite network, compromising site control.

Mitigation

Update to a version later than 2.0.8 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221
• https://plugins.trac.wordpress.org/changeset/3515646
• https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cve
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner