Security readout for executives and security teams
Plain-English summary
A WordPress import/export plugin flaw can let an unauthenticated attacker become an administrator, but only on sites with specific plugin settings and prior CSV import conditions. Administrator takeover can lead to full site compromise, data theft, content changes, and malware placement.
Executive priority
Prioritize remediation for public-facing WordPress sites meeting the exposure conditions. Treat confirmed exposure as urgent because successful exploitation grants administrator control. Sites without the required setting and prior import condition are lower immediate risk but should still update when vendor guidance is available.
Technical view
CVE-2026-3629 affects Import and export users and customers for WordPress through 1.29.7. The save_extra_user_profile_fields function can update insufficiently restricted user meta keys. Sensitive keys such as wp_capabilities were not blocked, enabling privilege escalation when profile fields are shown and a CSV previously introduced that column.
Likely exposure
Exposure is limited to WordPress sites using this plugin at version 1.29.7 or earlier, with “Show fields in profile” enabled, and a prior CSV import containing a wp_capabilities column header.
Exploitation context
The CVSS score is 8.1 with network access, no privileges, and no user interaction, but attack complexity is high due to required site state. KEV is false, and the provided sources do not state active exploitation.
Researcher notes
Sources identify the vulnerable logic and a WordPress.org changeset, but the bundle does not clearly name a fixed release. Avoid assuming broad exposure: exploitation depends on plugin configuration and prior imported column state. No provided source confirms in-the-wild exploitation.
Mitigation direction
- Identify WordPress sites running this plugin at version 1.29.7 or earlier.
- Check vendor or WordPress plugin guidance for a fixed version and update promptly.
- Disable “Show fields in profile” if not required.
- Review imported CSV templates and remove sensitive user meta columns.
- Audit administrator accounts and recent registrations for unexpected privilege changes.
Validation and detection
- Confirm installed plugin name and version on each WordPress site.
- Verify whether “Show fields in profile” is enabled.
- Review prior imports for a wp_capabilities column header.
- Check usermeta records for unexpected administrator capabilities.
- Review web and WordPress logs around recent registrations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-3629 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/48dd9098-38e6-49da-8d22-27e12fddef51?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/columns.php#L193CVE reference
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/1.29.7/classes/helper.php#L146CVE reference
- https://plugins.trac.wordpress.org/changeset/3483330/import-users-from-csv-with-meta#file37CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.