Security Alert Summary
The Import and export users and customers WordPress plugin contains a privilege enforcement vulnerability that can allow users with the create_users capability to create or promote accounts to administrator during a CSV import. Sites running affected versions prior to 2.5.2 should review their user roles and plugin usage.
CVE Details
- CVE ID:
CVE-2026-92540 - Affected component: Import and export users and customers WordPress plugin
- Affected versions: Versions before 2.5.2 (example affected version listed: 2.4.16)
- Published: September 20, 2026 at 7:16:51 AM
- Last modified: September 20, 2026 at 2:17:00 PM
- CVSS v3.1: Base score 7.2 – HIGH; Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User interaction:
- Privileges required: High
- User interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-269 (Improper Privilege Management)
Technical Details
The plugin does not correctly enforce the promote_users capability when assigning roles during a CSV import process. As described, this allows an account that only has the create_users capability to create new administrator accounts or to promote existing users to administrator.
This is a capability-checking defect in the import flow: the import routine assigns roles without validating that the performing user has the required promote_users capability. The result is privilege escalation limited to user creation and role assignment actions performed via CSV import.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff who manage content, and external contractors who may handle user onboarding via CSV imports. If a contractor or staff member has the create_users capability but not the intended higher privilege to change roles, this vulnerability could allow them to create administrator accounts or elevate other accounts to administrator.
- Exposure of internal user data: elevated accounts could view or export user details, including email addresses and profile information.
- Increased risk of targeted phishing or social engineering: attackers or malicious insiders with elevated access can read user emails and other sensitive details to craft convincing phishing attempts.
- Integrity and availability risks: newly promoted administrators could modify site content, change settings, or install plugins leading to broader site impact in line with the CVSS integrity and availability ratings.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and contractors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and user creation logs for unusual behavior related to CSV imports or new admin accounts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
