WordPress Plugin Flaws Enable Privilege Escalation to Administrator

Two newly disclosed vulnerabilities in WordPress plugins can let attackers elevate privileges to Administrator by abusing improper handling of user profile metadata. CVE-2026-4261 affects Expire Users through version 1.2.2, where the save_extra_user_profile_fields function allows modification of the on_expire_default_to_role meta value; an authenticated attacker with Subscriber-level access or higher can exploit the flaw to gain full administrative control. The issue was classified as CWE-862 and carries a high-severity CVSS v3.1 score with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

A second flaw, CVE-2026-3629, impacts Import and export users and customers through version 1.29.7 and can, under specific conditions, allow even unauthenticated attackers to become administrators. The plugin's save_extra_user_profile_fields logic fails to block sensitive keys such as wp_capabilities because get_restricted_fields does not restrict them, enabling a crafted registration request to assign elevated privileges when "Show fields in profile" is enabled and a previously imported CSV included a wp_capabilities column header. That vulnerability was classified as CWE-269 with a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.