UNKNOWN NVD

CVE-2026-92541

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, all

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

References

https://wpscan.com/vulnerability/b31fb9ee-9f65-43d0-88fa-da99513f8a3b/

Published: 2026-09-20 · Source: NVD · Feed updated: 2026-09-20

This unknown severity vulnerability was published on 2026-09-20 via NVD.

vulnfeed aggregates 14846 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.