CVE-2026-92540
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Sep 20, 2026
Vendor
unknown
Description
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.