CVE-2026-92540: Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has the create_users capability can exploit it. They do not need the promote_users capability that should normally be required to assign or grant the administrator role.
What access or action is required for exploitation?
The attacker needs access to perform a CSV user import through the affected plugin. They can use that import to create a new administrator account or promote an existing user to administrator.
Which plugin versions are affected?
Versions of Import and export users and customers before 2.5.2 are affected. Updating to version 2.5.2 or later removes the described capability-enforcement issue.