UNKNOWN NVD

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CS

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

References

https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/

Published: 2026-09-20 · Source: NVD · Feed updated: 2026-09-20

This unknown severity vulnerability was published on 2026-09-20 via NVD.

vulnfeed aggregates 14846 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.