CVE-2026-92540 in Import and export users and customers Plugin
Summary
by MITRE • 09/20/2026
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in the Import and export users and customers WordPress plugin prior to version 2.5.2 represents a critical failure in role-based access control mechanisms within the application's bulk user management functionality. This flaw specifically targets the CSV import feature, which is designed to facilitate the mass creation or modification of user accounts by administrators. The core technical deficiency lies in the improper enforcement of WordPress capability checks during this process. Specifically, while the plugin correctly validates certain permissions for general user operations, it fails to verify whether the initiating user possesses the promote_users capability when assigning roles that elevate a user's privilege level, such as promoting an existing account or creating a new one with administrator privileges. In standard WordPress architecture, the ability to assign administrative roles is strictly reserved for users holding both create_users and promote_users capabilities, typically limited to super administrators in multisite installations or primary admins in single-site environments. By neglecting this specific check during CSV imports, the plugin effectively bypasses these security boundaries, allowing any user with merely the basic create_users capability to escalate their own privileges or those of other accounts to the highest level available on the platform.
From a technical perspective, this vulnerability exploits the gap between intended administrative workflows and actual code execution logic. When an administrator uploads a CSV file containing user data, the plugin parses the entries and attempts to apply the specified roles. The security flaw occurs because the validation routine does not cross-reference the current user's capabilities against the target role being assigned during this specific operation. Consequently, if a lower-privileged user with permission to create new users submits a request that includes an administrator role assignment for themselves or another account, the system accepts and processes it without raising an exception or denying access. This behavior contradicts the principle of least privilege and undermines the integrity of the WordPress capability hierarchy. The vulnerability is particularly dangerous because CSV imports are often used by developers and site managers to migrate data, meaning that if a compromised lower-privileged account gains access to this feature, the attacker can immediately escalate privileges without needing further exploits or social engineering tactics beyond initial authentication.
The operational impact of this vulnerability is severe, as it leads directly to unauthorized privilege escalation and potential full system compromise. An authenticated attacker with low-level permissions can transform their account into an administrator, thereby gaining complete control over the WordPress installation. This includes the ability to install malicious plugins, modify theme files, access sensitive database information, and execute arbitrary code depending on plugin configurations. Furthermore, because this affects user management, it allows for the creation of persistent backdoor accounts that remain even if the initial entry point is patched or discovered. The attacker can then move laterally within the network, exfiltrate data, deface the website, or use the compromised server as a pivot point for further attacks against internal infrastructure. This aligns with common attack patterns where initial access through weak credentials or other vulnerabilities is leveraged to gain administrative control, significantly increasing the blast radius of any subsequent breach.
In terms of industry standards and threat modeling, this vulnerability maps directly to CWE-269, which describes Improper Privilege Assignment. The failure to enforce role-based restrictions during a specific operational context allows users to assume privileges they are not authorized to hold. Additionally, from an offensive security perspective such as the MITRE ATT&CK framework, this flaw facilitates the T1078 technique of Valid Accounts and specifically supports privilege escalation tactics where attackers leverage existing credentials to gain higher-level access. The lack of proper capability checks during bulk operations is a common oversight in legacy or poorly maintained plugins, highlighting the importance of rigorous input validation and permission verification across all user-facing endpoints, not just standard administrative pages.
To mitigate this vulnerability, immediate action must be taken by upgrading the Import and export users and customers plugin to version 2.5.2 or later, where the developers have addressed these capability checks. Site administrators should also audit existing user roles to ensure that no accounts with unnecessary create_users permissions exist unless absolutely required for specific operational needs. Implementing strict role-based access control policies and regularly reviewing WordPress capabilities can help prevent similar issues in other plugins. Furthermore, enabling two-factor authentication adds a layer of security against initial credential compromise, reducing the likelihood of an attacker gaining even low-level access that could be exploited to trigger this privilege escalation flaw. Regular vulnerability scanning and keeping all third-party extensions updated are essential practices for maintaining the integrity of WordPress-based environments.