Import Export Users CVE-2026-92540

Requires an authenticated account holding the create_users capability but NOT promote_users - a non-default configuration typically produced by a role-editor/custom-role plugin that delegates user management to a non-administrator. The site must run 'Import and export users and customers' in a version between 2.4.16 and before 2.5.2, and the attacker must be able to reach the plugin's CSV import function. No end-user interaction is needed (UI:N). On a default WordPress install where only administrators hold create_users (and they already hold promote_users), the flaw yields no escalation - this deployment dependency is the primary limiter on real-world risk.

This is a genuine privilege-escalation flaw that merits prompt patching but sits below the top tier because exploitation is gated on an unusual privilege prerequisite. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N with C:H/I:H/A:H) scores 7.2 (High) and correctly captures full compromise on success, but the PR:H rating is debatable and internally revealing: the entire point of the vulnerability is that a LOWER-privileged delegated user (holding create_users but deliberately denied promote_users) escalates to administrator, so I assess PR:L rather than PR:H - which would raise the real severity to roughly 8.8. A public exploit exists (WPScan) and a vendor patch (2.5.2) is available, so the exploitation status is 'publicly available exploit code exists' - this is NOT confirmed active exploitation; there is no CISA KEV listing and no EPSS score in the input, so widespread automated abuse is not evidenced. The real limiter is deployment-specific: standard WordPress grants create_users only to administrators (who already have promote_users), so exploitation requires a site using a custom/role-editor configuration that splits these capabilities - a delegated user-management setup. Where that configuration exists, this is a real priority (full site takeover); where it does not, practical risk is low.

On a WordPress site that uses a role plugin to grant a non-admin 'user manager' role the create_users capability while withholding promote_users, that user opens the plugin's CSV import and includes an administrator role assignment for a new or existing account. The plugin fails to check promote_users during import and provisions/promotes the account to administrator, yielding full site takeover. A public exploit is available via WPScan, lowering the skill bar.