CVE-2026-92540 Overview
CVE-2026-92540 is a privilege escalation vulnerability in the Import and export users and customers WordPress plugin before version 2.5.2. The plugin fails to enforce the promote_users capability when assigning roles during a CSV import operation. Users holding only the create_users capability can craft a CSV file that creates new administrator accounts or promotes existing users to administrator. The flaw maps to CWE-269: Improper Privilege Management and results in full site takeover from a lower-privileged account.
Critical Impact
An authenticated user with create_users capability can escalate to administrator, gaining full control over the WordPress site, its content, and connected data stores.
Affected Products
- Import and export users and customers WordPress plugin, all versions before 2.5.2
- WordPress sites where the plugin is installed and activated
- WooCommerce deployments that use the plugin to bulk-manage customer accounts
Discovery Timeline
- 2026-09-20 - CVE-2026-92540 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-92540
Vulnerability Analysis
The Import and export users and customers plugin exposes a CSV import feature that accepts a role column for each user record. During processing, the plugin creates or updates user accounts and assigns the specified role directly. WordPress core reserves role promotion to accounts holding the promote_users capability, which is normally granted only to administrators. The plugin skips this capability check and relies solely on the broader create_users capability to gate access to the import endpoint. An authenticated actor with a custom role that includes create_users can therefore assign the administrator role to any imported or updated user, including themselves through a secondary account.
Root Cause
The defect is missing authorization enforcement during role assignment. The import handler validates that the caller can create users, but does not re-check whether the caller can promote users to the role specified in the CSV. Because WordPress treats create_users and promote_users as distinct capabilities, environments that delegate user creation to non-administrator roles inherit the escalation path.
Attack Vector
Exploitation requires an authenticated session with the create_users capability. The attacker uploads a CSV containing a target username, email, and a role field set to administrator. The plugin processes the file server-side and writes the elevated role into the wp_usermeta table. The attacker then authenticates as the new administrator account or as the promoted existing user. Refer to the WPScan Vulnerability Analysis for the technical write-up.
Detection Methods for CVE-2026-92540
Indicators of Compromise
- Unexpected accounts appearing in wp_users with the administrator role assigned in wp_usermeta
- CSV upload events targeting the plugin's import endpoint originating from non-administrator sessions
- Role changes on existing user accounts logged shortly after a CSV import job
- New administrator logins from IP addresses not previously seen for privileged sessions
Detection Strategies
- Audit the WordPress user table for administrator accounts created after the plugin was installed and correlate them with plugin import logs
- Enable WordPress activity logging plugins that record capability changes and role reassignments
- Alert on any POST request to the plugin's import handler where the authenticated user does not hold the administrator role
Monitoring Recommendations
- Forward WordPress and web server access logs to a centralized logging platform and alert on role escalation events
- Monitor filesystem writes to wp-content/uploads for CSV files followed by database writes to wp_usermeta setting wp_capabilities to administrator
- Track authentication events for accounts whose role changed within the last 24 hours
How to Mitigate CVE-2026-92540
Immediate Actions Required
- Update the Import and export users and customers plugin to version 2.5.2 or later
- Review all WordPress accounts and remove any unauthorized administrator users
- Rotate credentials for legitimate administrator accounts and force session invalidation
- Audit custom roles and remove create_users from any role that does not require it
Patch Information
The vendor addressed the missing capability check in version 2.5.2 of the plugin. Sites running any earlier release remain vulnerable. Details are available in the WPScan Vulnerability Analysis.
Workarounds
- Deactivate the Import and export users and customers plugin until the patched version is deployed
- Restrict the create_users capability to trusted administrator accounts only
- Place the WordPress admin area behind additional authentication such as IP allowlisting or a web application firewall rule blocking the plugin's import endpoint for non-administrator sessions
# Update the plugin via WP-CLI
wp plugin update import-users-from-csv-with-meta --version=2.5.2
# Verify installed version
wp plugin get import-users-from-csv-with-meta --field=version
# Identify unexpected administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
