Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-7641

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a0feed4ae55e667c8fdaf539b5903012d3a8c7dd0d3105d175ef9fc3c7fabd13
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"Import and export users and customers","vendor":"carazo","versions":[{"lessThanOrEqual":"2.0.8","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/problemTypes/0/descriptions/0

Source references

14 source assertions
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L198"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/10
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/columns.php#L221"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/9
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/helper.php#L150"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/11
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.6/classes/multisite.php#L21"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/12
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L198"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/columns.php#L221"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/helper.php#L150"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.0.8/classes/multisite.php#L21"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/8
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L198"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/columns.php#L221"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/helper.php#L150"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/multisite.php#L21"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/7
{"url":"https://plugins.trac.wordpress.org/changeset/3515646"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/13
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:336527f869be43c8412288e62c50a2e90b3ae77a984e865e97c5dc9f918b4664 · sha256:56c3df58950e952b… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer