CVE-2026-92541

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

CVE-2026-92541 Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...

EUVD-2026-83678

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promoteusers capability in its front-end import functionality, allowing users with only the createusers capability to change the role of existing users, including promoting them to administrator...