Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields

This research plan outlines the steps required to demonstrate an unauthenticated privilege escalation to Administrator in the "Import and export users and customers" plugin.

1. Vulnerability Summary

The "Import and export users and customers" plugin (versions <= 1.29.7) contains a privilege escalation vulnerability. The plugin identifies "extra" user meta fields by tracking column headers from previously imported CSV files. When the "Show fields in profile" setting is enabled, the plugin's save_extra_user_profile_fields function (hooked to user_register and profile_update) iterates through all $_POST data. It updates user meta for any key that matches a "discovered" extra field, provided the key is not in a restricted list.

The vulnerability exists because get_restricted_fields (which uses the acui_restricted_fields filter) fails to include the sensitive wp_capabilities meta key. If an administrator has previously imported a CSV containing a wp_capabilities column, an unauthenticated attacker can provide that key during registration to grant themselves the Administrator role.

2. Attack Vector Analysis

• Endpoint: wp-login.php?action=register (Standard WordPress registration).
• HTTP Method: POST
• Parameters:
  • user_login: The desired username.
  • user_email: The desired email.
  • wp_capabilities[administrator]: Set to 1 to grant the administrator role.
• Authentication: None (Unauthenticated).
• Preconditions:
  1. WordPress must have registration enabled (users_can_register).
  2. The plugin setting "Show fields in profile" (or "Show fields in registration form") must be enabled.
  3. An administrator must have previously imported a CSV with a column header named wp_capabilities. This "registers" the field in the plugin's allowed list.

3. Code Flow

1. Entry Point: wp-login.php?action=register calls register_new_user().
2. User Creation: register_new_user() calls wp_insert_user().
3. Hook Trigger: wp_insert_user() triggers the user_register action hook.
4. Vulnerable Sink: The plugin's save_extra_user_profile_fields($user_id) function is executed via the user_register hook.
5. Field Discovery: The function retrieves a list of allowed extra fields (those discovered during previous CSV imports).
6. Bypassed Restriction: The function calls get_restricted_fields() to filter the $_POST keys. Since wp_capabilities is not in the returned array of restricted fields, it remains in the processing queue.
7. Meta Update: The function calls update_user_meta( $user_id, 'wp_capabilities', $_POST['wp_capabilities'] ).
8. Role Escalation: WordPress processes the array ['administrator' => '1'] and serializes it, effectively granting the new user the Administrator role.

4. Nonce Acquisition Strategy

The exploitation of the user_register hook through the standard WordPress registration form does not require a WordPress nonce for the user_register action itself.

However, if the plugin's settings page requires a nonce for configuration (which the agent will need for setup), the agent should:

1. Navigate to the plugin settings page.
2. Use browser_eval to extract any nonce if needed for administrative actions, or use wp-cli to modify options directly to simplify the PoC setup.

5. Exploitation Strategy

Step 1: Environment Setup (via WP-CLI)
Enable registration and the required plugin setting.

# Enable user registration
wp option update users_can_register 1
wp option update default_role subscriber

# Enable the specific plugin setting (Grounded in plugin option structure)
# The plugin stores settings in 'acui_settings'
wp eval '
$settings = get_option("acui_settings", []);
$settings["show_fields_in_profile"] = "yes";
update_option("acui_settings", $settings);
'

Step 2: Seed the Vulnerability (Precondition)
Import a CSV with the `wp