CVE-2026-86583: Privilege Escalation in WordPress Plugin

CVE-2026-86583 describes a privilege escalation vulnerability in the WordPress plugin 'Import and export users and customers'. The flaw affects the user export-reimport workflow: export uses fputcsv() with NUL byte as escape character, while import uses SplFileObject::fgetcsv() with backslash escape character. Combined with CSV column order (display_name before role, nickname after), an authenticated attacker can insert crafted profile field values to cause incorrect cell merging and obtain Administrator role at reimport.

The vulnerability has CVSS 8.8 in the High category. It requires an authenticated attacker with minimum Subscriber-level access and administrator intervention to manually run the documented export-reimport procedure with both 'Update existing users' and 'Update roles for existing users' flags set to 'yes'. The vulnerability was published on NVD on September 23, 2026. A GitHub signal appeared on November 4, 2026, indicating the existence of public repositories declaring to contain exploit code for this vulnerability.

Security teams and WordPress administrators must immediately verify the installation of the 'Import and export users and customers' plugin in their environments. If present, disable the plugin until an official patch is available. Alternatively, prevent use of the user export-reimport function, or temporarily disable one or both of the 'Update existing users' and 'Update roles for existing users' flags during migration operations. Check access logs and user lists for signs of anomalies or privilege escalation already occurred.