CVE-2026-3629: WordPress Plugin Privilege Escalation Flaw

CVE-2026-3629 Overview

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This vulnerability exists due to the save_extra_user_profile_fields function not properly restricting which user meta keys can be updated via profile fields. The get_restricted_fields method does not include sensitive meta keys such as wp_capabilities, making it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the wp_capabilities meta key.

Critical Impact

Unauthenticated attackers can achieve full Administrator access to WordPress installations by exploiting improper access controls in user meta field handling, potentially leading to complete site compromise.

Affected Products

• Import and export users and customers plugin for WordPress versions up to and including 1.29.7
• WordPress installations with the vulnerable plugin where "Show fields in profile" setting is enabled
• Sites where a CSV with a wp_capabilities column header has been previously imported

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-3629 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3629

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) stems from inadequate restrictions on user meta key updates within the WordPress plugin's profile field handling mechanism. The vulnerability requires specific conditions to be exploitable: the "Show fields in profile" setting must be enabled, and a CSV file containing a wp_capabilities column header must have been previously imported into the system.

When these conditions are met, the plugin's save_extra_user_profile_fields function fails to properly validate and restrict which user meta keys can be modified through profile field submissions. The get_restricted_fields method, which should serve as a safeguard against sensitive field modifications, does not include critical WordPress meta keys like wp_capabilities in its restricted list. This oversight allows attackers to inject arbitrary capability assignments through crafted registration requests.

Root Cause

The root cause lies in the incomplete implementation of the get_restricted_fields method within the plugin's columns.php and helper.php classes. The method was designed to prevent modification of sensitive user meta fields but failed to account for the wp_capabilities meta key, which WordPress uses to store user role and permission assignments. This oversight creates a gap in the access control mechanism that attackers can exploit to assign themselves Administrator-level capabilities.

Attack Vector

The attack is network-based and can be executed by unauthenticated users. An attacker would craft a malicious registration request that includes the wp_capabilities field set to Administrator privileges. When the plugin processes this request through the save_extra_user_profile_fields function, it bypasses the incomplete field restrictions and directly updates the user's capabilities in the WordPress database.

The vulnerability mechanism operates through the profile field handling functions. The save_extra_user_profile_fields function at columns.php L193 processes user-submitted profile data without adequate filtering. The restriction logic at columns.php L217 and helper.php L146 fails to include wp_capabilities in the blocked field list, allowing privilege escalation through crafted requests.

Detection Methods for CVE-2026-3629

Indicators of Compromise

• Unexpected user accounts with Administrator privileges appearing in the WordPress user database
• User registration logs showing accounts being created with elevated capabilities
• Database entries showing wp_capabilities modifications outside of normal administrative workflows
• Unusual profile field update activity in WordPress audit logs

Detection Strategies

• Monitor WordPress user creation events for accounts immediately assigned Administrator roles
• Implement database auditing to track changes to the wp_usermeta table, particularly the wp_capabilities meta key
• Review web server logs for POST requests to registration endpoints containing suspicious capability-related parameters
• Deploy Web Application Firewall (WAF) rules to detect and block requests attempting to set wp_capabilities through registration forms

Monitoring Recommendations

• Enable WordPress security logging to capture user registration and role assignment events
• Configure alerts for any new Administrator account creation outside of expected administrative actions
• Periodically audit user accounts and their assigned capabilities to identify unauthorized privilege escalations
• Monitor the Import and export users and customers plugin configuration for unexpected changes to the "Show fields in profile" setting

How to Mitigate CVE-2026-3629

Immediate Actions Required

• Update the Import and export users and customers plugin to a version newer than 1.29.7 immediately
• Disable the "Show fields in profile" setting if the feature is not actively required
• Audit all existing WordPress user accounts for unauthorized Administrator privileges
• Review and remove any previously imported CSV files containing wp_capabilities column headers

Patch Information

A patch addressing this vulnerability is available through the WordPress Plugin Changeset. Site administrators should update to the latest patched version through the WordPress admin panel or by manually downloading the updated plugin from the WordPress plugin repository. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Disable the "Show fields in profile" setting in the plugin configuration to prevent exploitation
• Remove any imported CSV files that contain a wp_capabilities column header from the system
• Implement additional access controls or WAF rules to block registration requests containing capability modification attempts
• Consider temporarily deactivating the plugin until the update can be applied if immediate patching is not possible

# WordPress CLI commands to audit and manage user capabilities
# List all users with Administrator role
wp user list --role=administrator --format=table

# Check specific user capabilities
wp user get <username> --field=roles

# Remove unauthorized admin privileges (replace USER_ID)
wp user set-role USER_ID subscriber