Skip to content
Sign in
7.2 High

CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in…

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Affected products and versions

Product Affected versions Fixed in
Import and export users and customers 2.5 earliest → < 2.5.2 2.5.2

Other CVEs of Import and export users and customers

The 7 CVEs of Import and export users and customers →
CVE-2026-92540 The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users… 7.2 High CVE-2026-16542 The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before… 4.1 Medium CVE-2025-15673 The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads… 4.9 Medium CVE-2026-16534 The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and… 9.1 Critical
Track this CVE