WordPress Plugin Vulnerabilities

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

Description

The plugin does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Proof of Concept

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 2.5.2

References

CVE
CVE-2026-92541

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
BINESH MADHARAPU
Submitter
BINESH MADHARAPU
Verified
Yes
WPVDB ID
b31fb9ee-9f65-43d0-88fa-da99513f8a3b

Timeline

Publicly Published
2026-09-18 (about 2 days ago)
Added
2026-09-18 (about 1 day ago)
Last Updated
2026-09-18 (about 1 day ago)

Other

Published
Title
Published
2026-06-10
Title
Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping
Published
2025-05-19
Title
CouponXL <= 4.5.0 - Unauthenticated Privilege Escalation
Published
2026-09-18
Title
Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
Published
2026-01-12
Title
xSmart <= 1.2.9.4 - Subscriber+ Privilege Escalation
Published
2026-05-22
Title
Wishlist Member < 3.32.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action