A vulnerability in the 'Import and export users and customers' WordPress plugin before version 2.4.2 allows privilege escalation through CSV import functionality. The plugin fails to enforce WordPress role-assignment and per-user edit permissions during CSV imports. A low-privileged user with only user-creation capability can exploit this flaw to create administrator accounts. Additionally, the vulnerability allows overwriting existing administrator passwords or email addresses. This effectively enables account takeover of administrator accounts. The issue has been patched in version 2.4.2 of the plugin.