CVE-2026-94178
HighCVSS 7.5Summary
The Import and export users and customers plugin in versions up to and including 2.5.2 contains a Privilege Escalation vulnerability exploitable by a Subscriber-level user. This allows privileges to be elevated.
Risk Assessment
A low-privileged attacker (Subscriber) can escalate their privileges, gaining access to administrative functions and potentially taking over the site.
Recommendation
Update the Import and export users and customers plugin to a version newer than 2.5.2.
Other vulnerabilities in Import and export users and customers
See all- CVE-2026-16534Critical
The 'Import and export users and customers' WordPress plugin before version 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- CVE-2026-15026Medium
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 2.4.0. Authenticated attackers with subscriber-level access or higher can extract the post_title and raw post_content of arbitrary posts regardless of status or post type by enumerating post IDs. The required nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
Original NVD description (English source)
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS