CVE-2026-92540 – The Import and export users and customers WordPress plugin before 2.5.2 does not correctly

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.