PT-2026-26947 · WordPress · Wordpress Import/Export Users/Customers

Supanat Konprom · Published 2026-03-21 · Updated 2026-05-19 · CVE-2026-3629

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Import and export users and customers plugin for WordPress versions prior to 1.29.8

Description An issue allows unauthenticated attackers to escalate privileges to Administrator by submitting a crafted registration request that sets the wp capabilities meta key. This occurs because the save extra user profile fields() function does not properly restrict which user meta keys can be updated via profile fields, and the get restricted fields() method fails to include sensitive meta keys like wp capabilities. Exploitation is only possible if the "Show fields in profile" setting is enabled and a CSV file containing a wp capabilities column header has been previously imported.

Recommendations Update the plugin to a version later than 1.29.7. As a temporary workaround, disable the "Show fields in profile" setting to minimize the risk of exploitation.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-3629

Affected Products

Wordpress Import/Export Users/Customers

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-3629 · Security Note
• https://twitter.com/CVEnew/status/2035619728107176399 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/48dd9098-38e6-49da-8d22-27e12fddef51?source=cve · Note
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/columns.php#L217 · Note
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/columns.php#L193 · Note
• https://twitter.com/VulmonFeeds/status/2035504692252250619 · Twitter Post
• https://twitter.com/RedPacketSec/status/2035596713369432303 · Twitter Post
• https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/helper.php#L146 · Note
• https://twitter.com/akaclandestine/status/2056675177409192207 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3483330/import-users-from-csv-with-meta#file37 · Note
• https://twitter.com/TheHackerWire/status/2035495938039648572 · Twitter Post