The vulnerability in the carazo 'Import and export users and customers' WordPress plugin (up to version 2.0.8) involves improper privilege management (CWE-269) in the save_extra_user_profile_fields() function. The plugin correctly blocks capability meta keys for the primary site but neglects to block equivalent keys for subsites in a WordPress Multisite environment. This incomplete blocklist allows these subsite-prefixed keys (e.g., wp_2_capabilities) to bypass checks and be written to user meta via update_user_meta(), enabling privilege escalation. An authenticated user with Subscriber-level access or above can exploit this by submitting a crafted profile update to /wp-admin/profile.php, provided an administrator has previously imported a CSV containing multisite-prefixed capability columns and enabled the 'Show fields in profile?' option, which exposes these keys as editable fields on user profiles. No patch or official fix has been published yet.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to escalate privileges to Administrator on any subsite within a WordPress Multisite network. This can lead to full control over the subsite, including content modification, user management, and potential further compromise of the network. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid importing CSV files containing multisite-prefixed capability columns and refrain from enabling the 'Show fields in profile?' option. Additionally, restrict Subscriber-level user access and monitor for unusual profile updates. Apply updates promptly once a vendor patch or official fix becomes available.