WordPress Plugin Vulnerabilities

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

Description

The plugin does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Proof of Concept

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 2.5.2

References

CVE
CVE-2026-92540

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
yzx001
Submitter
yzx001
Verified
Yes
WPVDB ID
3a112d4b-9824-4128-ad6a-25b928e6fbdd

Timeline

Publicly Published
2026-09-18 (about 2 days ago)
Added
2026-09-18 (about 1 day ago)
Last Updated
2026-09-18 (about 1 day ago)

Other

Published
Title
Published
2026-09-03
Title
ACPT (Premium) < 2.0.67 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
Published
2026-08-28
Title
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
Published
2025-05-20
Title
Spreadsheet Price Changer for WooCommerce and WP E-commerce <= 2.4.37 - Unauthenticated Privilege Escalation
Published
2025-04-11
Title
WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
Published
2024-07-01
Title
Ultimate Addons for Elementor < 1.36.32 - Authenticated (Contributor+) Privilege Escalation