CVE-2020-12074: 
WordPress vulnerability analysis and mitigation

The users-customers-import-export-for-wp-woocommerce WordPress plugin versions before 1.3.9 contained a critical security vulnerability identified as CVE-2020-12074. The vulnerability was discovered and publicly disclosed on March 11, 2020. This security flaw affected the user import functionality of the plugin, which is designed to handle CSV-based user imports in WordPress installations (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The technical issue is classified under CWE-269 (Improper Privilege Management). The vulnerability allows users with subscriber-level access to import new users via CSV files, including those with administrative privileges (NVD).

The vulnerability enables privilege escalation by allowing subscriber-level users to create administrative accounts through CSV file imports. This could lead to complete compromise of WordPress installations as malicious users could create administrator accounts and gain full control over the affected websites (WPScan).

The vulnerability can be exploited by sending a specially crafted POST request to '/wp-admin/admin-ajax.php' with specific parameters related to CSV file import. The exploit requires only subscriber-level authentication, making it relatively easy to execute for any authenticated user (WPScan).

The vulnerability was patched in version 1.3.9 of the users-customers-import-export-for-wp-woocommerce plugin. Site administrators are strongly advised to update to this version or later to protect their installations (Wordfence).