9.1
Critical
CVE-2026-16534 The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and…
Description
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Import and export users and customers 2.4 | earliest → < 2.4.2 | 2.4.2 |
Other CVEs of Import and export users and customers
The 7 CVEs of Import and export users and customers →
CVE-2026-92541
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in…
7.2
High
CVE-2026-92540
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users…
7.2
High
CVE-2026-16542
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before…
4.1
Medium
CVE-2025-15673
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads…
4.9
Medium