CVE-2026-92540CWE-269privilege-escalation

CVE-2026-92540

High · published September 20, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-09-20T11:16Z
References (1)
https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/ · [email protected]
EPSS history
Timeline
  • 21 SEP 03:37Z
    EPSS moved — → 0%
    epss
  • 20 SEP 06:00Z
    Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
    cvelistv5