CVE-2026-92541 — Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with …
Published: 2026-09-20 · CVSS: 7.2 · CVSS 3.1
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7