Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-92541

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Import and export users and customers

Default version status: unaffected

  • 0 to < 2.5.2affected

References