WordPress Plugin Privilege Escalation via CSV Import

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects the "Import and export users and customers" WordPress plugin versions before 2.5.2, where a critical authorization bypass allows users with basic user creation capabilities to escalate their own privileges to administrator level. The flaw stems from improper validation of the promote_users capability during CSV import operations, meaning attackers need only create_users permissions—a lower-privileged role—to bypass role assignment controls and create new admin accounts or elevate existing users. This is particularly dangerous in multi-user WordPress environments where content editors or other non-admin users might have legitimate user creation permissions, turning them into potential insider threats or giving external attackers a foothold to achieve full site compromise.

Casky's 224 matched security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) techniques embedded in this vulnerability. Practitioners using Casky would identify detection opportunities around suspicious CSV import activities—particularly monitoring for users without administrator roles initiating bulk user imports, unusual role assignment patterns that skip standard capability checks, and accounts unexpectedly gaining admin-level permissions after import operations. The platform's skill mapping would highlight specific indicators: detection of create_users capability being exercised in ways that modify admin roles, audit log anomalies showing role promotions without corresponding promote_users capability checks, and database modifications indicating unauthorized privilege escalation through the plugin's import functionality. By correlating these attack indicators with MITRE's privilege escalation framework, security teams gain visibility into exploitation attempts before attackers achieve persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92540.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-92540

Casky has 224 skills that investigate the attack patterns behind CVE-2026-92540. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn