Security Alert Summary
The Import and export users and customers WordPress plugin prior to version 2.5.2 fails to enforce the promote_users capability in its front-end import functionality. This allows users who have the create_users capability to change roles of existing accounts, including promoting them to the administrator role.
CVE Details
- CVE ID:
CVE-2026-92541 - Affected component: Import and export users and customers WordPress plugin (front-end import functionality)
- Affected versions: Versions before 2.5.2 (less than 2.5.2)
- Published: September 20, 2026 at 07:16:51 AM UTC
- Last modified: September 20, 2026 at 02:17:00 PM UTC
- CVSS v3.1: Base Score 7.2, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Privileges Required: High; User Interaction: None; Attack Vector: Network; Attack Complexity: Low
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness ID: CWE-269
Technical Details
The plugin does not enforce the promote_users capability in its front-end import functionality. Because that capability check is missing, an account that has the create_users capability can modify roles for existing users when using the import feature. The description explicitly notes that such an account can change roles, including promoting users to the administrator role.
The underlying issue is a missing authorization check around role changes in the import code path. The CVE description does not name specific functions or REST endpoints beyond the front-end import functionality, so the technical summary is limited to the capability enforcement failure and the resulting role modification vector.
How This Could Impact Your Website
In a realistic scenario, a site owner delegates user management to internal staff or an external contractor and grants the create_users capability for convenience. If the delegated account is compromised or misused, that account could be used to change roles for existing users, potentially elevating an account to administrator. That elevation could allow the actor to perform administrative actions, install plugins, or access sensitive site settings.
Other practical consequences include exposure of internal user email addresses during user management tasks and an increased risk of targeted phishing or social engineering against staff and contractors whose roles or contact details become known. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-administrative accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and audit logs for unusual behavior involving user role changes or account provisioning.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
