CVE-2026-92541 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

EUVD-2026-83677

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

EUVD-2026-83678

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92541 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92540

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) is vulnerable to privilege escalation . The software fails to correctly enforce the promote_users capability during a CSV import operation. This flaw allows users who only possess the create_users capability to by...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

WordPress Import and export users and customers plugin < 2.4.5 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Binesh Madharapu in WordPress Plugin Import and export users and customers versions 2.4.5...

EUVD-2026-83661

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-16542

The Import and export users and customers WordPress plugin, in versions before 2.4.5 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before performing server-side requests during a CSV import . This flaw allows high-privileged u...

CVE-2026-92541: Improper Privilege Management

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-16542: Server-Side Request Forgery (SSRF)

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

CVE-2026-92540: Improper Privilege Management

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-4792 Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality downloadsettings function which is registered on the pluginsloaded hook and explicit...

CVE-2026-4792 Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality downloadsettings function which is registered on the pluginsloaded hook and explicit...

CVE-2026-76554

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554

The WP Import Export Lite WordPress plugin (versions before 3.9.35 ) is vulnerable to an authenticated privilege escalation due to improper privilege management. The plugin fails to verify if a user running an import is authorized to create or modify user accounts and assign roles. This allows us...

EUVD-2026-83500

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...