What is the CVSS score of CVE-2026-92541?

CVE-2026-92541 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Import Export Users are affected by CVE-2026-92541?

Import Export Users plugin installations before version 2.5.2 are exposed to a privilege escalation that can allow lower-privileged accounts with the create_users capability to alter existing user…. A patch is available.

Is there a public PoC exploit available for CVE-2026-92541?

Yes, a public proof-of-concept exploit is available for CVE-2026-92541. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-92541?

Vendor-released patch: 2.5.2. Within 24 hours, inventory all WordPress sites running the Import Export Users plugin, confirm any version below 2.5.2, and update to 2.5.2 or later; if patching cannot be completed immediately, disable the plugin or remove the create_users capability from non-administrator roles as a temporary containment step. Within 7 days, verify the update across all environments, review user accounts and role assignments for unauthorized administrator additions or role changes, and rotate credentials or invalidate sessions for any accounts that may have been affected. Within 30 days, audit plugin and role-management policies, enforce least privilege for create_users, monitor for privilege escalation attempts, and validate that no systems remain on vulnerable versions. Publicly available exploit code exists, so treat exposed sites as urgent.

Import Export Users CVE-2026-92541

EUVD-2026-83678 HIGH

Improper Privilege Management (CWE-269)

2026-09-20 WPScan

GHSA-562f-rm3m-8jj6

WordPress Privilege Escalation Import And Export Users And Customers

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L not PR:H because the attacker holds only the delegated create_users capability, not admin; promotion to administrator yields full C/I/A:H impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 20, 2026 - 15:22 vuln.today

Analysis Generated

Sep 20, 2026 - 14:25 vuln.today

CVSS changed

Sep 20, 2026 - 14:22 NVD

7.2 (HIGH)

Patch available

Sep 20, 2026 - 07:01 EUVD

CVE Published

Sep 20, 2026 - 06:00 cve.org

HIGH 7.2

CVE Published

Sep 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - All High Severity, 7 With POC Sep 21, 2026

AnalysisAI

Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) an authenticated account holding the create_users capability but NOT promote_users - a delegated non-admin privilege - and (2) the plugin's front-end import functionality being reachable to that user. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to version 2.5.2 or later, which is the vendor-released patch that enforces the missing promote_users capability check. … Detailed patch versions, workarounds, and compensating controls in full report.