CVE-2026-92541 — Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Import…

CVE-2026-92541

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer PUBLISHED

Description (CNA)

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Affected (CNA)

Vendor / product	Versions
Unknown / Import and export users and customers	affected 0 before 2.5.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.