# CVE-2026-92540: Import and export users and customers privilege escalation in user role assignment

Source: https://junglewise.ai/threats/cve-2026-92540-the-import-and-export-users-and-customers-wordpress-plugin-before  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92540 · Severity: high · CVSS 7.2 · Published 2026-09-20

A WordPress plugin for importing and exporting user data fails to properly validate permissions when assigning administrator roles during CSV imports. An attacker with basic user creation privileges can exploit this to create new administrator accounts or promote themselves to administrator, gaining full control of the WordPress site.

Vendors: [DynamiApps](https://junglewise.ai/threats/vendors/dynamiapps).

## Quick answers

**Is CVE-2026-92540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92540 being exploited in the wild.

**How severe is CVE-2026-92540?** High severity, with a CVSS score of 7.2, published 20 September 2026.

**Which products and versions are affected?** DynamiApps Import and export users and customers before 2.5.2.

**Is there a fix for CVE-2026-92540?** A patch was published on 2026-09-20: Fixed in version 2.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92540 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92540?** Check whether you run DynamiApps Import and export users and customers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not correctly enforce the promote_users capability when assigning roles during CSV import operations, allowing users with only the create_users capability to bypass authorization checks. The vulnerability is triggered during the CSV import process where role assignment is performed without proper permission validation. A user with lower privileges can create new accounts with administrator role or escalate existing accounts, gaining unauthorized administrative access to the WordPress installation.

## Affected products

- DynamiApps Import and export users and customers before 2.5.2

## Timeline

- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 2.5.2

## References

- [https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/](https://wpscan.com/vulnerability/3a112d4b-9824-4128-ad6a-25b928e6fbdd/)