CVE-2026-92541
Received Received - Intake

Import Users and Customers Plugin Role Escalation

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-92541
EUVD
EUVD-2026-83678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
import_and_export_users_and_customers import_and_export_users_and_customers to 2.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation issue in the Import and export users and customers WordPress plugin before version 2.5.2. It allows users with only the create_users capability to change existing user roles, including promoting them to administrators, due to missing enforcement of the promote_users capability in the front-end import functionality.

Detection Guidance

Check if the 'Import and export users and customers' WordPress plugin is installed and verify its version. If the version is below 2.5.2, the system is vulnerable. Inspect user role changes in the WordPress admin panel, particularly those made through the front-end import feature.

Impact Analysis

An attacker with create_users capability could exploit this to escalate their privileges to administrator, gaining full control over the WordPress site. This could lead to unauthorized access, data theft, or complete site compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the 'Import and export users and customers' plugin to version 2.5.2 or later immediately. Review user roles and permissions to ensure no unauthorized privilege escalations occurred. Monitor for suspicious admin account creations or role changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart