CVE-2026-92540
UnknownSummary
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import. This allows users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Risk Assessment
A low-privileged user can create administrator accounts or promote existing accounts, leading to full site takeover. This poses a serious threat to the security of the WordPress installation.
Recommendation
Update the Import and export users and customers plugin to version 2.5.2 or later. An audit of user accounts for unauthorized role changes is also recommended.
Other vulnerabilities in Import and export users and customers WordPress plugin
See all- CVE-2026-92541Unknown
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality. This allows users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- CVE-2026-16542Unknown
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
- CVE-2025-15673Medium
The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Original NVD description (English source)
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.