{"id":"CVE-2026-94178","published":"2026-09-30T13:17:25.953","lastModified":"2026-09-30T14:17:43.553","description":"Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-2-5-2-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A privilege escalation vulnerability allows authenticated users to import and export customer data with elevated privileges, potentially leading to unauthorized access to sensitive information and system resources.","exploitability":"Exploitation requires an authenticated user account with import/export permissions, making it moderately difficult but achievable through social engineering or credential compromise.","blast_radius":"If exploited, this vulnerability could allow attackers to access and manipulate customer data, potentially leading to data breaches, unauthorized transactions, and privilege escalation across the affected system.","remediation":"Upgrade to version 2.5.3 or later to address the subscriber privilege escalation flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","import-export","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:05:32.762Z"}}