This CVE exploits a permission boundary collapse in a WordPress plugin's CSV user import feature. The plugin gated the bulk import operation on the create_users capability, which in WordPress architecture controls account creation but has no opinion on role hierarchy. Role assignment and modification of other users' profiles normally require edit_users — a distinct capability that gates exactly the privilege escalation this CVE enables. An authenticated user with only create_users permission could import a CSV specifying administrative roles, instantly elevating themselves or others to admin.
The vulnerability exists because WordPress's capability model is fine-grained but not architecturally enforced against bulk operations. The developer implemented what made cognitive sense: 'import users' is a 'create users' task, so gate it with create_users. But importing a user with an admin role isn't just creating an account — it's assigning the highest privilege level in the system. The security-relevant question ('does this caller have permission to assign roles?') was never asked, because the mental model was data import, not permission modeling.
If you're auditing WordPress plugins for similar issues, examine any bulk operation that touches user fields. The pattern to watch: a single capability gate protecting an operation that, if decomposed into its constituent actions, would require multiple different capabilities in normal WordPress UX. Specifically, any user-import, user-update, or user-migration feature should be checked against both create_users and edit_users — the operation needs the latter if it can modify existing users or assign roles to newly-created ones.
The fix requires a role-checking gate: the importer must verify the calling user holds edit_users before applying any role field from the CSV. This seems like a simple missing check, but the deeper lesson is that bulk operations create a structural bypass of WordPress's carefully-separated permission topology. WordPress ensures role assignment requires edit_users at every normal interaction point — the CSV import pathway was architecturally invisible to that enforcement. Treat bulk user operations as a distinct security surface requiring explicit permission modeling, not as a natural extension of the capability that gates single-user creation.