Is CVE-2026-92541 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92541?

CVE-2026-92541 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-92541

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.