CVE-2026-92541: Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator.
Affected Software
Event History
Frequently Asked Questions
Which accounts are realistically able to exploit this issue?
An attacker needs an account with the create_users capability. The vulnerable front-end import function can then be used to change roles of existing users, including assigning the administrator role.
Are sites affected if users do not have the create_users capability?
The described attack requires create_users. The available information does not establish exposure for accounts without that capability.
What version should be installed to address the issue?
Update the Import and export users and customers plugin to version 2.5.2 or later. Versions before 2.5.2 are affected.
What can be done if the plugin cannot be updated immediately?
Restrict the create_users capability to only fully trusted accounts and prevent untrusted users from accessing the plugin's front-end import functionality. Review existing user roles for unexpected administrator assignments.