CVE-2026-86583: CWE-266 Incorrect Privilege Assignment in carazo Import and export users and customers
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".
AI Analysis
Technical Summary
CVE-2026-86583 is a privilege escalation vulnerability in the carazo Import and export users and customers WordPress plugin versions up to and including 2.4.17. The vulnerability stems from a mismatch in CSV parsing: the exporter uses fputcsv() with a NUL byte as the escape character, while the importer uses SplFileObject::fgetcsv() with only a delimiter argument, causing PHP's default backslash escape to be applied. Because of the column layout (display_name before role, nickname after), an attacker can craft display_name and nickname fields to manipulate the CSV parsing, merging display_name into the role field and causing the role to be set to administrator during import. This allows authenticated users with Subscriber or higher roles to escalate to Administrator privileges if a site administrator triggers the plugin's export and re-import with both "Update existing users" and "Update roles for existing users" options enabled.
Potential Impact
An attacker with authenticated access at Subscriber level or above can escalate their privileges to Administrator by exploiting the CSV parsing inconsistency during the plugin's export and re-import workflow. This results in full administrative control over the WordPress site, potentially leading to complete site compromise. Exploitation requires a site administrator to perform the export and re-import with specific options enabled, so the attack depends on administrative action to trigger the vulnerability.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Until a vendor advisory or patch is released, administrators should avoid performing the export and re-import operations with both "Update existing users" and "Update roles for existing users" set to "yes". Restrict access to the plugin's export and import functionality to trusted administrators only. Monitor vendor advisories for updates and apply official fixes once available.
CVE-2026-86583: CWE-266 Incorrect Privilege Assignment in carazo Import and export users and customers
Description
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both "Update existing users" and "Update roles for existing users" set to "yes".
CVSS v3.1
Score 8.8high
Affected software
carazo
Import and export users and customers
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86583 is a privilege escalation vulnerability in the carazo Import and export users and customers WordPress plugin versions up to and including 2.4.17. The vulnerability stems from a mismatch in CSV parsing: the exporter uses fputcsv() with a NUL byte as the escape character, while the importer uses SplFileObject::fgetcsv() with only a delimiter argument, causing PHP's default backslash escape to be applied. Because of the column layout (display_name before role, nickname after), an attacker can craft display_name and nickname fields to manipulate the CSV parsing, merging display_name into the role field and causing the role to be set to administrator during import. This allows authenticated users with Subscriber or higher roles to escalate to Administrator privileges if a site administrator triggers the plugin's export and re-import with both "Update existing users" and "Update roles for existing users" options enabled.
Potential Impact
An attacker with authenticated access at Subscriber level or above can escalate their privileges to Administrator by exploiting the CSV parsing inconsistency during the plugin's export and re-import workflow. This results in full administrative control over the WordPress site, potentially leading to complete site compromise. Exploitation requires a site administrator to perform the export and re-import with specific options enabled, so the attack depends on administrative action to trigger the vulnerability.
Mitigation Recommendations
No official patch or fix is currently confirmed for this vulnerability. Until a vendor advisory or patch is released, administrators should avoid performing the export and re-import operations with both "Update existing users" and "Update roles for existing users" set to "yes". Restrict access to the plugin's export and import functionality to trusted administrators only. Monitor vendor advisories for updates and apply official fixes once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-08T06:53:28.117Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab445a0f7a7c541065c1c81
Added to database: 09/23/2026, 21:33:20 UTC
Last enriched: 09/23/2026, 21:47:40 UTC
Last updated: 09/24/2026, 03:23:33 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.