carazo Import and Export Users and Customers Plugin up to 1.29.7 on WordPress save_extra_user_profile_fields privileges management

Summaryinfo

A vulnerability was found in carazo Import and Export Users and Customers Plugin up to 1.29.7 on WordPress. It has been declared as critical. Affected by this issue is the function save_extra_user_profile_fields. The manipulation results in privileges management. This vulnerability is identified as CVE-2026-3629. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in carazo Import and Export Users and Customers Plugin up to 1.29.7 on WordPress. Affected is the function save_extra_user_profile_fields. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.

The weakness was released by Supanat Konprom. The advisory is available at wordfence.com. This vulnerability is traded as CVE-2026-3629 since 03/06/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 1.29.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-14256). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• carazo

Name

• Import and Export Users and Customers Plugin

Version

• 1.29.0
• 1.29.1
• 1.29.2
• 1.29.3
• 1.29.4
• 1.29.5
• 1.29.6
• 1.29.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion