Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-92540

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Import and export users and customers

Default version status: unaffected

  • 2.4.16 to < 2.5.2affected

References