CVE-2026-92540

Executive Summary

CVE-2026-92540 is a privilege-escalation vulnerability in the WordPress plugin "Import and export users and customers" affecting all versions before 2.5.2. The plugin fails to correctly enforce the promote_users capability when assigning roles during a CSV import, allowing an actor holding only the create_users capability to create brand-new administrator accounts or promote existing accounts to administrator. Any WordPress site running a vulnerable version and exposing user-creation rights to non-administrative roles (editors, membership managers, or custom roles) is at risk of full site takeover.

Technical Analysis

The vulnerability resides in the CSV import workflow of the "Import and export users and customers" WordPress plugin. WordPress ships a granular capability system in which user-creation rights (create_users) are intentionally separated from role-assignment rights (promote_users). A user who may create accounts should not necessarily be able to decide that those accounts are administrators; that decision is gated behind promote_users and, in the WordPress core UI, behind explicit safeguards preventing a user from granting a role more privileged than their own.

Per the NVD description, the plugin's CSV import routine does not correctly enforce promote_users when it assigns roles during import. The practical consequence is a capability-check bypass in the role-assignment path: the import code honors the caller's ability to create users (create_users) but fails to verify that the same caller is permitted to assign the role specified in the imported data (e.g., a role column in the CSV that names administrator). Because the role from the CSV is applied without a promote_users gate, the effective privilege boundary between "can create a user" and "can create an administrator" collapses.

This is a classic access-control / privilege-management flaw (CWE-269). It is not a memory-safety issue, not an injection flaw, and not a remote-code-execution primitive in itself. The attack surface is the plugin's administrative CSV import feature (an authenticated, capability-gated interface within wp-admin), reachable over HTTP by any authenticated principal possessing create_users but not promote_users. No authentication bypass is required — the flaw is that a lower-privileged but legitimately authenticated user can escalate to the highest role on the site.

Because privilege escalation to administrator in WordPress grants control over themes, plugins, and the built-in code editor (where enabled), the flaw functions as a stepping stone to full compromise. However, the specific post-escalation path depends on site configuration and is not part of the described vulnerability itself.

Damage to confidentiality/integrity/availability: An attacker who gains an administrator account can read and modify any content, install or alter plugins and themes, and — on misconfigured installations — achieve code execution. Availability impact is high in the sense that an administrator can deface or disable the site.

No CVE, CWE, or CVSS was formally assigned in the provided data; the CWE and CVSS vector above are analytic inferences from the described behavior, clearly labeled as such.

Exploitation Scenarios

No public proof-of-concept is available. The following chain is inferred from the vulnerability class and the NVD description; no specific function names, file paths, or parameters are asserted beyond those stated in the description (create_users, promote_users, "CSV import", "roles").

1. Reconnaissance / target identification. The attacker enumerates WordPress sites running the "Import and export users and customers" plugin at a version below 2.5.2 (fingerprintable via the plugin's static assets or the admin menu entry). The attacker needs, at minimum, valid credentials for a role that has been granted the create_users capability — commonly an editor, a site manager, or a custom membership/HR role configured to allow bulk user onboarding through CSV.

2. Triggering the flaw class. The attacker authenticates and navigates to the plugin's CSV import interface in wp-admin. A CSV file is prepared whose rows represent new users (or existing users) together with a role assignment. Crucially, the role field is populated with administrator. Under correct behavior, the import should reject this because the caller lacks promote_users; under the vulnerable behavior described, that check is not enforced.

3. Payload / execution (vulnerability-class level). The attacker uploads/imports the crafted CSV. The plugin processes it, creates a new account with the imported credentials, and applies the imported role — administrator — because the promote_users capability gate was not correctly applied during import. Alternatively, the attacker supplies an existing account they control and has the import promote it to administrator. No memory corruption or code injection is required; the "payload" is simply a role value in user-supplied import data.

4. Post-exploitation impact. The attacker now holds an administrator account. Depending on site configuration, this permits installing a malicious plugin/theme, editing plugin or theme files via the WordPress editor, creating additional backdoor administrator accounts, exfiltrating user data and PII, and persisting across password resets. Removal of the backdoor accounts becomes difficult without full remediation.

Access prerequisites: authenticated session with create_users; no user interaction beyond the attacker's own actions (UI:N); low complexity (AC:L); network reachable (AV:N). The inferred CVSS vector above reflects these conditions; note that NVD has not published a CVSS score for this CVE.

Exploit maturity: No public PoC, no Nuclei template, no known exploit code, and not listed in CISA KEV as of the data provided. Exploitation is plausible for a motivated attacker but currently not weaponized in the public domain per available evidence.

Impact Assessment

Business impact. Successful exploitation yields administrative control of the target WordPress installation. This enables site defacement, data theft (user records, customer data, order information in WooCommerce-integrated sites), injection of malicious redirects or SEO spam, and persistent backdoors. For organizations running WordPress as a customer-facing storefront or CMS with delegated user-management roles, the confidentiality, integrity, and availability impact is high across the board.

Affected systems. Any WordPress instance with the "Import and export users and customers" plugin at a version below 2.5.2. Risk is materially higher where non-administrator roles have been granted create_users (a common configuration in membership, marketplace, and multi-author editorial setups).

Blast radius. Because administrator access in WordPress is effectively root-level for the application, the blast radius for a single compromised site is total for that site. In multisite or federated SSO environments, lateral movement to related assets is possible if credentials are shared or SSO trust is misconfigured.

CVSS subscores (inferred, not assigned). Inferred vector: AV:N (network-reachable admin interface), AC:L (no special conditions), PR:L (requires authenticated low-privileged account), UI:N (no victim interaction), S:U (impact stays within the WordPress security authority), C:H/I:H/A:H (full administrative read/write and availability control). The official CVSS score is N/A and no vector has been published by NVD. These values are provided for analytical context only and must not be treated as an authoritative score.

Detection Guidance

Sigma Rule

title: WordPress Import Users CSV Privilege Escalation Attempt (CVE-2026-92540)
id: 7f3c9a12-4b2e-4d67-9c81-1a2b3c4d5e6f
status: experimental
description: Detects CSV import activity in the Import and export users and customers plugin that may indicate attempted role escalation to administrator.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92540
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1078.004
  - attack.t1548
logsource:
  category: web
  product: apache
  definition: WordPress access logs for the plugin CSV import endpoint
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'import-users-from-csv'
      - 'import-users-from-csv-with-meta'
  selection_action:
    cs-uri-query|contains: 'action='
  selection_post:
    cs-method: 'POST'
  condition: selection_endpoint and selection_post
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate administrative CSV imports of users
level: medium

YARA Rule

rule CVE_2026_92540_WordPress_CSV_Import_PrivEsc
{
    meta:
        description = "Detects CSV import payloads attempting to assign the administrator role via the Import and export users and customers WordPress plugin"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92540"
        date = "2026-01-01"
        severity = "high"

    strings:
        $role1 = "administrator" ascii nocase
        $role2 = "role" ascii nocase
        $role3 = "user_login" ascii nocase
        $role4 = "user_email" ascii nocase
        $csvdelim = "," ascii

    condition:
        (uint32(0) != 0x504b0304) and
        filesize < 5MB and
        $role1 and
        (2 of ($role2, $role3, $role4)) and
        #csvdelim > 5
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92540 WordPress Import Users CSV Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"import-users-from-csv"; http.uri; content:"admin"; http.request_body; content:"administrator"; http.request_body; content:"role"; classtype:attempted-admin; sid:2026925401; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-92540;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ http.request where http.request.method == "POST" and
      http.request.uri contains "import-users-from-csv" and
      http.request.body contains "administrator" ]

Splunk SPL Query

index=web sourcetype=access_combined
(http.url="*import-users-from-csv*" OR http.url="*import-users-from-csv-with-meta*")
http_method=POST
| eval suspicious=if(match(_raw, "(?i)administrator") AND match(_raw, "(?i)role"), "ROLE_ESCALATION_ATTEMPT", "import_activity")
| where suspicious="ROLE_ESCALATION_ATTEMPT"
| stats count values(uri_path) as paths values(src_ip) as source_ips by user suspicious
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,cve-2026-92540,">
  <rule id="2026925" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/wp-admin/.*import-users-from-csv.*</url>
    <method>POST</method>
    <description>CVE-2026-92540: Possible WordPress CSV import role escalation to administrator</description>
    <mitre>
      <id>T1078.004</id>
      <id>T1548</id>
    </mitre>
  </rule>
  <rule id="2026926" level="12">
    <if_sid>2026925</if_sid>
    <match>administrator</match>
    <description>CVE-2026-92540: Confirmed administrator role assignment during CSV import</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source, no vendor advisory is available, and no confirmed fixed-version artifact has been verified. The NVD description indicates the vulnerability is addressed in version 2.5.2, but this cannot be independently confirmed from the provided data. Treat the environment as unpatched until verified.

1) Immediate mitigations

• Audit all WordPress roles and capabilicies. Remove the create_users capability from any role that should not have it, and grant promote_users only to trusted administrators. If no non-administrator role genuinely requires create_users, revoke it.
• Restrict access to the plugin's import interface to administrators only.
• Enforce least privilege: never grant combined user-management capabilities to editor, author, or custom membership roles without a documented business need.
• Harden wp-admin with IP allow-listing, HTTP authentication, or a Web Application Firewall (WAF) rule blocking POST requests to the plugin's import endpoints from untrusted sources.
• Monitor for unexpected new administrator accounts and alert on any creation of a user with the administrator role.

2) Patch / upgrade steps

• Upgrade the "Import and export users and customers" plugin to version 2.5.2 or later as soon as a verified release is obtainable, and re-test the role-assignment path after upgrade.
• Verify the fixed version by attempting to assign an administrator role via CSV import while authenticated as a create_users-only user; the import should be rejected.
• Because no vendor patch source is currently tracked, validate the fix independently before relying on it in production.

3) Long-term hardening

• Implement a formal WordPress capability-review process for every plugin that manages users; create_users and promote_users should rarely be delegated.
• Deploy account-creation and role-change monitoring across all WordPress sites.
• Maintain a plugin inventory with version tracking and subscribe to NVD/advisory feeds for the plugin.
• Adopt a staging-first upgrade policy and require MFA on all administrative accounts.

References

1. NVD — CVE-2026-92540: https://nvd.nist.gov/vuln/detail/CVE-2026-92540
2. WordPress Plugin Directory — "Import and export users and customers": https://wordpress.org/plugins/import-users-from-csv-with-meta/
3. WordPress Developer Reference — Roles and Capabilities: https://wordpress.org/documentation/article/roles-and-capabilities/
4. CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
5. FIRST.org EPSS (CVE not yet scored): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No known threat actor campaigns, no public PoC, no Nuclei template, no exploit code, and the CVE is not listed in CISA KEV based on the data provided. No exploitation in the wild has been confirmed. Threat intelligence sources should continue to be monitored given the trivial nature of the privilege-escalation mechanism once a low-privileged foothold exists.