CVE-2026-92541 PUBLISHED

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

Assigner: WPScan
Reserved: 16.09.2026 Published: 20.09.2026 Updated: 20.09.2026

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Product Status

Vendor Unknown
Product Import and export users and customers
Versions Default: unaffected
  • affected from 0 to 2.5.2 (excl.)

Credits

  • BINESH MADHARAPU finder
  • WPScan coordinator

References

Problem Types

  • CWE-269 Improper Privilege Management CWE