CVE-2026-92541
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Sep 20, 2026
Vendor
unknown
Description
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.