explaingit

pysectools/cve-2026-3629

★ 9PythonAudience · ops devopsComplexity · 2/5ActiveLicenseSetup · easy

TLDR

Python CLI that checks if a WordPress site is exposed to CVE-2026-3629, an unauth privilege escalation in the Import and export users and customers plugin.

Mindmap

mindmap
  root((CVE-2026-3629))
    Inputs
      Target URL
      Test username
      Test email
    Outputs
      Vulnerable verdict
      Safe verdict
      Coloured banner
    Use Cases
      Scan owned WordPress sites
      Confirm plugin patch level
      Authorised pentests
    Tech Stack
      Python
      requests
      colorama

Things people build with this

USE CASE 1

Check your own WordPress site for the unauth admin takeover bug

USE CASE 2

Confirm a plugin update to 1.29.8 actually closed CVE-2026-3629

USE CASE 3

Sweep a list of client sites during an authorised audit

USE CASE 4

Demo a CVE writeup in a classroom or lab

Tech stack

Pythonrequestscolorama

Getting it running

Difficulty · easy Time to first run · 5min

Clone, pip install requests and colorama, then run against a URL; only meaningful on sites you are allowed to test.

MIT licence lets anyone use, modify, and redistribute the code as long as the copyright notice is kept.

In plain English

This repository is a small Python command-line tool that checks whether a WordPress site is exposed to a specific known security flaw. The flaw is tracked as CVE-2026-3629 and lives in a WordPress plugin called "Import and export users and customers". The README rates the issue at CVSS 8.1, which it labels as high severity, and explains that the plugin's save_extra_user_profile_fields function does not block a user-meta key called wp_capabilities. According to the README, this oversight can let an unauthenticated attacker create an account with full Administrator privileges and take over the site. The README lists the affected plugin versions as 1.29.7 or earlier, fixed in 1.29.8. It also spells out two preconditions that must both be true for the flaw to be exploitable: the plugin's "Show fields in profile" setting must be enabled, and a CSV file containing a wp_capabilities column must have been imported. Credit for discovery is given to Supanat Konprom, with a disclosure date of March 21, 2026. To install the checker, a user clones the repo with git and then installs two Python packages, "requests" and "colorama", with pip. The tool is then run as "python3 cve_2026_3629_checker.py" followed by a target URL. Optional arguments let the user override the test username, the test email address, and the network timeout, which defaults to 30 seconds. The README provides example output blocks showing what a vulnerable site versus a safe site looks like, including a coloured banner and a final verdict line. The README ends with a short mitigation section: update the plugin to 1.29.8 or higher, disable the "Show fields in profile" option, and check existing admin accounts for unauthorised users. There is a clear legal disclaimer stating that the tool is for educational use and authorised testing only, plus links to the maintainer's GitHub and Telegram channel, donation wallet addresses, references to Wordfence and the NVD, and an MIT licence note.

Copy-paste prompts

Prompt 1
Show me how to run cve_2026_3629_checker.py against a staging WordPress URL
Prompt 2
Wrap this checker in a bash loop that scans a list of domains and writes results to a CSV
Prompt 3
Explain what wp_capabilities is and why blocking it stops the privilege escalation
Prompt 4
Add a flag to cve_2026_3629_checker.py that exits non-zero when the site is vulnerable
Prompt 5
Help me draft the disclosure note for a client whose site fails this check
Open on GitHub → Explain another repo

Generated 2026-05-22 · Model: sonnet-4-6 · Verify against the repo before relying on details.