CASE FILE RT-0291 Vulnerability research

0-day in a WordPress plugin: privilege escalation to administrator

Our own 0-day: Import Users from CSV ≤ 1.3.1 let a user with nothing but the create_users capability create full administrators via CSV import. CVSS 7.2 — the write-up and PoC are public.

Objective: Test the hypothesis that role restrictions during user import can be bypassed through wp_capabilities metadata
Path: A missing authorization check (CWE-862) in the import handler: the plugin never verified who may assign arbitrary roles. A CSV of user_login,user_email,user_pass,role,wp_capabilities — with role=administrator or the serialized a:1:{s:13:"administrator";b:1;} — created full administrators from a low-privileged (low-importer) account. Logging in under the created account meant complete control of the site: plugins, themes, code execution.
Detected: Exploitation leaves almost no trace: creating users looks like the plugin's normal job. Watch for administrators created outside the admin UI and for import entries in audit logs

After: The 0-day was reported to the vendor; the write-up and PoC are public (codeby.net, Sep 28, 2026). Until a patch: never grant create_users outside the administrators, disable the plugin, monitor newly created admins.

Names, sectors and infrastructure details are changed; timelines and tradecraft are not. More case files →

The pattern in one page

A capability without a check is a hole. create_users with no question of who may assign roles.
Serialized metadata is the second way in. Even when the role field is filtered, wp_capabilities rides in with the CSV.
Third-party plugins are part of your perimeter. A CMS audit must include reading plugin code, not just checking versions.

Recognize the pattern?

We can verify	Typical effort
The same path against your estate, under signed ROE	2–4 wks
Detection validation: what your SOC would have seen	included
Retest after fixes, within three months	free

Start a conversation — reply within two business days

Could this path exist in your estate?

Tell us your crown jewels — we will tell you how close this case file is to your reality.

Request assessment