CVE-2026-7641: WordPress Multisite Privilege Escalation Via Plugin

The Import and export users and customers plugin for WordPress, in all versions up to and including 2.0.8, is vulnerable to privilege escalation. The National Vulnerability Database reports this flaw, CVE-2026-7641, stems from an incomplete blocklist within the save_extra_user_profile_fields() function. While the plugin correctly restricts capability meta keys for the primary WordPress site (e.g., wp_capabilities), it fails to block equivalent keys for subsites in a Multisite network (e.g., wp_2_capabilities). This allows these subsite-specific keys to bypass in_array() checks and be written directly to user meta via update_user_meta().

This vulnerability enables authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator on any subsite within a WordPress Multisite network. Exploitation requires a crafted profile update submitted to /wp-admin/profile.php. Crucially, an administrator must have previously imported a CSV file containing multisite-prefixed capability column headers and enabled the ‘Show fields in profile?’ option, which exposes these keys as editable fields on the user profile page. The National Vulnerability Database assigns a CVSS score of 8.8 (HIGH) to this flaw.

This isn’t just a coding error; it’s a critical logic bypass in a WordPress Multisite environment. Attackers aren’t guessing credentials; they’re leveraging a fundamental trust failure in how user capabilities are handled across the network. For any organization running WordPress Multisite, this is a glaring hole, turning a low-privileged user into a full administrator on a subsite. The fact that it requires a prior admin action (CSV import) doesn’t negate the risk; many large WordPress deployments rely on such import functionalities for user management.