Khanhnv

**Name of the Vulnerable Software and Affected Versions** Import and export users and customers plugin for WordPress versions prior to 2.4.18 **Description** An issue exists in the export and re-import workflow that allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. The problem occurs because the exporter uses `fputcsv()` with a NUL byte as the escape character, while the importer uses `SplFileObject::fgetcsv()` with default PHP backslash escape characters. By crafting specific values in the `display name` and `nickname` profile fields, an attacker can cause the parser to merge the `display name` cell into the role field during import. This results in the `add role()` function assigning the administrator role to the attacker's account. Exploitation requires a site administrator to perform an export and re-import migration with both Update existing users and Update roles for existing users enabled. **Recommendations** Update the plugin to a version newer than 2.4.17.