7.2
Élevée
CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in…
Description
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Import and export users and customers 2.5 | premières → < 2.5.2 | 2.5.2 |
Autres CVE de Import and export users and customers
Les 7 CVE de Import and export users and customers →
CVE-2026-92540
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users…
7.2
Élevée
CVE-2026-16542
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before…
4.1
Moyenne
CVE-2025-15673
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads…
4.9
Moyenne
CVE-2026-16534
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and…
9.1
Critique