CVE-2026-86583 is a privilege escalation vulnerability in the WordPress Import and export users and customers plugin affecting all versions up to and including 2.4.17. The vulnerability is due to a mismatch in CSV escaping: the exporter uses fputcsv() with a NUL byte as the escape character, while the importer uses SplFileObject::fgetcsv() with the default backslash escape. This causes crafted values in the display_name and nickname profile fields to merge and manipulate the role column during import, allowing an attacker to gain administrator privileges. Exploitation requires an authenticated user with at least Subscriber access and a site administrator to trigger the export and re-import workflow with "Update existing users" and "Update roles for existing users" set to "yes."

An attacker with Subscriber-level access or above can escalate their privileges to Administrator by exploiting this vulnerability. This can lead to full site compromise, including control over site content, settings, and user management. The vulnerability requires a site administrator to perform the export and re-import process with specific options enabled, so exploitation depends on administrator action.

No patch or official fix is currently documented. Mitigation requires avoiding the export and re-import workflow with both "Update existing users" and "Update roles for existing users" enabled until a fix is available. Site administrators should be cautious about performing this operation and restrict access to users with at least Subscriber privileges. Monitor vendor advisories for updates and patches addressing this vulnerability.