CVE-2026-86583 in Import and export users and customers Plugin
Summary
by MITRE • 09/24/2026
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The Import and Export Users and Customers plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 2.4.17. This flaw arises from an inconsistency in how the plugin handles CSV data during its export and subsequent re-import workflow, specifically regarding character escaping mechanisms. The vulnerability allows authenticated attackers with subscriber-level access or higher to escalate their privileges to administrator level under specific conditions involving administrative action on the exported file.
The technical root cause lies in a mismatch between the escape characters used by the exporter and those expected by the importer during CSV processing. When exporting user data, the plugin utilizes PHP's fputcsv function with a NUL byte as the designated escape character to handle special characters within field values. However, when importing this same file back into the system using SplFileObject::fgetcsv(), the code provides only a single delimiter argument without specifying an explicit escape character. Consequently, PHP defaults to using the backslash as the escape sequence for parsing the CSV data. This discrepancy creates a scenario where characters that were safely escaped during export are misinterpreted during import due to the different escaping rules applied by each function.
The exploitation of this vulnerability relies on specific column ordering within the exported CSV file and crafted input in user profile fields. The plugin's export layout places the display_name field immediately before the role column, with the nickname field positioned directly after it. An attacker can exploit this structure by storing specially crafted values containing NUL bytes or backslashes in their own display_name and nickname profile fields via the standard WordPress profile page. When these values are exported, they are encoded using the NUL byte escape sequence. Upon re-importing the file with the mismatched parser settings, the SplFileObject function interprets the data incorrectly due to its reliance on backslash escaping. This misinterpretation causes the parser to merge the display_name cell into the role field and rebalance the column count through the nickname field. As a result, the import_user function receives administrator as the parsed role for the attacker's row when it calls add_role, effectively granting them administrative privileges despite originally holding only subscriber-level access.
Successful exploitation requires more than just an authenticated user with low-privilege access; it necessitates cooperation from a site administrator. The attacker must have their crafted profile data exported by an admin who then triggers the plugin's documented export re-import migration feature. Crucially, this administrative action must include both Update existing users and Update roles for existing users set to yes. Without these specific settings enabled during the import process, the privilege escalation vector remains inactive because the role update logic is not triggered or applied correctly.
From a security classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it allows an unauthorized user to gain elevated access rights through flawed input validation and processing logic. It also relates to CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically regarding the failure to maintain consistent escaping rules between data generation and consumption phases. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1068 Exploitation for Privilege Escalation, where an attacker leverages software vulnerabilities or misconfigurations to increase their level of access within a system environment.
Mitigation strategies should focus on immediate patching and configuration hardening. Users running affected versions must upgrade the plugin to version 2.4.18 or later, which resolves the escaping inconsistency by ensuring that both export and import operations use compatible escape character configurations. Until patches are applied, administrators should avoid using the re-import feature with the Update roles option enabled unless absolutely necessary for data migration purposes. Additionally, implementing strict input validation on user profile fields to prevent storage of characters that could disrupt CSV parsing logic can provide an additional layer of defense against similar exploitation attempts in other plugins or custom code segments handling external file imports.