CVE-2026-92541

The Import and Export Users and Customers plugin for WordPress versions prior to 2.5.2 is vulnerable due to a lack of enforcement of the promote_users capability, enabling users with only the create_users permission to elevate existing users' roles, potentially granting them administrative access. This vulnerability poses a significant risk to site security, as unauthorized users could gain elevated privileges. WordPress site administrators using this plugin should prioritize updating to version 2.5.2 or later to mitigate this risk.