CVE-2026-92541: WordPress Plugin Privilege Escalation

CVE-2026-92541 Overview

CVE-2026-92541 is a privilege escalation vulnerability [CWE-269] in the Import and export users and customers WordPress plugin before version 2.5.2. The plugin's front-end import functionality fails to enforce the promote_users capability check. Users holding only the create_users capability can modify roles of existing users, including elevating accounts to administrator. The flaw enables lower-privileged users to seize full site control by promoting themselves or others through crafted import operations.

Critical Impact
Authenticated users with create_users capability can escalate any account to administrator, resulting in complete WordPress site compromise.

Affected Products

Import and export users and customers WordPress plugin versions prior to 2.5.2
WordPress sites granting the create_users capability to non-administrator roles
WooCommerce deployments using the plugin for customer imports

Discovery Timeline

2026-09-20 - CVE-2026-92541 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92541

Vulnerability Analysis

The vulnerability resides in the plugin's front-end import handler. WordPress separates user management into distinct capabilities: create_users permits account creation, while promote_users controls role assignment on existing accounts. The plugin's import logic accepts role changes for existing users without verifying the caller holds promote_users. An attacker with only account-creation rights can submit an import that updates the role field of any existing user, including administrators.

The impact extends beyond self-promotion. Attackers can demote legitimate administrators, hijack established accounts to bypass audit trails, or provision new administrator accounts through the same code path. Full site takeover follows, enabling arbitrary plugin installation, content modification, and pivoting to server-level access.

Root Cause

The root cause is a missing capability check in the front-end import routine. The code path validates account creation authority but omits the corresponding current_user_can('promote_users') check before applying role assignments to existing accounts. This maps to [CWE-269: Improper Privilege Management].

Attack Vector

Exploitation requires an authenticated session with create_users capability, which is not granted to default WordPress roles but is commonly delegated to custom roles in membership, LMS, and multi-vendor sites. The attacker submits a crafted import file through the plugin's front-end interface, referencing existing usernames or IDs with modified role values. The plugin processes the import and updates roles without capability enforcement, granting the specified privileges. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-92541

Indicators of Compromise

Unexpected role changes in the wp_usermeta table for the wp_capabilities key
New administrator accounts created through the plugin's import endpoint
POST requests to the plugin's front-end import handler from non-administrator sessions
WordPress audit log entries showing role promotions without corresponding admin activity

Detection Strategies

Monitor WordPress user_role change events and correlate the acting user's capabilities against the operation performed
Review web server logs for POST requests to plugin import endpoints originating from subscriber, editor, or custom-role sessions
Audit installed plugin versions across WordPress fleets to identify instances running versions prior to 2.5.2

Monitoring Recommendations

Enable a WordPress activity log plugin that captures role changes, user creation, and plugin import events
Alert on any account promotion to administrator outside of change-management windows
Baseline expected users of the import functionality and flag deviations

How to Mitigate CVE-2026-92541

Immediate Actions Required

Update the Import and export users and customers plugin to version 2.5.2 or later
Audit all WordPress accounts holding the create_users capability and review recent role changes
Revoke administrator privileges from any account promoted without authorization and rotate credentials
Disable the plugin's front-end import feature if it is not required for business operations

Patch Information

Upgrade to version 2.5.2 or later, which enforces the promote_users capability check in the front-end import handler. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the create_users capability to trusted administrator roles until the patch is applied
Block access to the plugin's front-end import URL at the web server or WAF layer for non-administrator sessions
Deactivate the plugin entirely if immediate patching is not feasible

bash

# Example: restrict access to the plugin's front-end import endpoint via nginx
location ~* /wp-content/plugins/import-export-users-customers/ {
    allow 10.0.0.0/8;   # internal admin network
    deny all;
}