WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by BINESH MADHARAPU in WordPress Plugin Import and export users and customers versions 2.5.2...

WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by yzx001 in WordPress Plugin Import and export users and customers versions 2.5.2...

CVE-2026-92541

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-16542

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-92540 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-92540 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-92540

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) is vulnerable to privilege escalation . The software fails to correctly enforce the promote_users capability during a CSV import operation. This flaw allows users who only possess the create_users capability to by...

EUVD-2026-83677

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

EUVD-2026-83678

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92541 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92541

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) contains a privilege escalation vulnerability. The plugin fails to enforce the promote_users capability within its front-end import functionality. Consequently, an attacker with only the create_users capability ca...

CVE-2026-92541 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

WordPress Import and export users and customers plugin < 2.4.5 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Binesh Madharapu in WordPress Plugin Import and export users and customers versions 2.4.5...

CVE-2026-16542

The Import and export users and customers WordPress plugin, in versions before 2.4.5 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before performing server-side requests during a CSV import . This flaw allows high-privileged u...

EUVD-2026-83661

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

PT-2026-95931

Name of the Vulnerable Software and Affected Versions Import and export users and customers versions prior to 2.5.2 Description Insufficient enforcement of the promote users capability within the front-end import functionality allows users who possess only the create users capability to modify th...

PT-2026-95930

Name of the Vulnerable Software and Affected Versions Import and export users and customers versions prior to 2.5.2 Description Insufficient enforcement of the promote users capability during CSV imports allows users who possess only the create users capability to create new administrator account...