CVE-2026-92540: WordPress Plugin Privilege Escalation Flaw

CVE-2026-92540 Overview

CVE-2026-92540 is a privilege escalation vulnerability in the Import and export users and customers WordPress plugin before version 2.5.2. The plugin fails to enforce the promote_users capability when assigning roles during a CSV import operation. Users holding only the create_users capability can craft a CSV file that creates new administrator accounts or promotes existing users to administrator. The flaw maps to CWE-269: Improper Privilege Management and results in full site takeover from a lower-privileged account.

Critical Impact
An authenticated user with create_users capability can escalate to administrator, gaining full control over the WordPress site, its content, and connected data stores.

Affected Products

Import and export users and customers WordPress plugin, all versions before 2.5.2
WordPress sites where the plugin is installed and activated
WooCommerce deployments that use the plugin to bulk-manage customer accounts

Discovery Timeline

2026-09-20 - CVE-2026-92540 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92540

Vulnerability Analysis

The Import and export users and customers plugin exposes a CSV import feature that accepts a role column for each user record. During processing, the plugin creates or updates user accounts and assigns the specified role directly. WordPress core reserves role promotion to accounts holding the promote_users capability, which is normally granted only to administrators. The plugin skips this capability check and relies solely on the broader create_users capability to gate access to the import endpoint. An authenticated actor with a custom role that includes create_users can therefore assign the administrator role to any imported or updated user, including themselves through a secondary account.

Root Cause

The defect is missing authorization enforcement during role assignment. The import handler validates that the caller can create users, but does not re-check whether the caller can promote users to the role specified in the CSV. Because WordPress treats create_users and promote_users as distinct capabilities, environments that delegate user creation to non-administrator roles inherit the escalation path.

Attack Vector

Exploitation requires an authenticated session with the create_users capability. The attacker uploads a CSV containing a target username, email, and a role field set to administrator. The plugin processes the file server-side and writes the elevated role into the wp_usermeta table. The attacker then authenticates as the new administrator account or as the promoted existing user. Refer to the WPScan Vulnerability Analysis for the technical write-up.

Detection Methods for CVE-2026-92540

Indicators of Compromise

Unexpected accounts appearing in wp_users with the administrator role assigned in wp_usermeta
CSV upload events targeting the plugin's import endpoint originating from non-administrator sessions
Role changes on existing user accounts logged shortly after a CSV import job
New administrator logins from IP addresses not previously seen for privileged sessions

Detection Strategies

Audit the WordPress user table for administrator accounts created after the plugin was installed and correlate them with plugin import logs
Enable WordPress activity logging plugins that record capability changes and role reassignments
Alert on any POST request to the plugin's import handler where the authenticated user does not hold the administrator role

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized logging platform and alert on role escalation events
Monitor filesystem writes to wp-content/uploads for CSV files followed by database writes to wp_usermeta setting wp_capabilities to administrator
Track authentication events for accounts whose role changed within the last 24 hours

How to Mitigate CVE-2026-92540

Immediate Actions Required

Update the Import and export users and customers plugin to version 2.5.2 or later
Review all WordPress accounts and remove any unauthorized administrator users
Rotate credentials for legitimate administrator accounts and force session invalidation
Audit custom roles and remove create_users from any role that does not require it

Patch Information

The vendor addressed the missing capability check in version 2.5.2 of the plugin. Sites running any earlier release remain vulnerable. Details are available in the WPScan Vulnerability Analysis.

Workarounds

Deactivate the Import and export users and customers plugin until the patched version is deployed
Restrict the create_users capability to trusted administrator accounts only
Place the WordPress admin area behind additional authentication such as IP allowlisting or a web application firewall rule blocking the plugin's import endpoint for non-administrator sessions

bash

# Update the plugin via WP-CLI
wp plugin update import-users-from-csv-with-meta --version=2.5.2

# Verify installed version
wp plugin get import-users-from-csv-with-meta --field=version

# Identify unexpected administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered