CVE-2026-7641:

A privilege escalation vulnerability in the "Import and export users and customers" WordPress plugin (versions up to and including 2.0.8) allows authenticated attackers with Subscriber-level access to escalate their privileges to Administrator on any subsite within a WordPress Multisite network.

CVE-2026-7641 is a high-severity privilege escalation vulnerability affecting the "Import and export users and customers" WordPress plugin in all versions up to and including 2.0.8. The flaw stems from an incomplete capability meta key blocklist within the `save_extra_user_profile_fields()` function. While the plugin correctly blocks primary site meta keys such as `wp_capabilities` and `wp_user_level`, it fails to account for subsite-specific equivalents used in WordPress Multisite environments (e.g., `wp_2_capabilities`). This oversight allows these keys to pass the blocklist check and be written to user meta, enabling authenticated attackers with as little as Subscriber-level access to escalate their privileges to Administrator on any subsite in the network. Exploitation is conditional on an administrator having imported a CSV with multisite-prefixed capability headers and having enabled the profile field display option.