WordPress Plugin Privilege Escalation via User Import

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Import and export users and customers WordPress plugin before version 2.5.2 contains a privilege escalation vulnerability that fails to properly enforce capability restrictions on its front-end import functionality. Specifically, the plugin allows users with only the create_users capability to modify user roles and promote accounts to administrator level—a function that should be restricted to users with the promote_users capability. This is particularly dangerous because WordPress sites often grant create_users permissions to content managers, HR personnel, or contributor-level administrators who should never have the ability to elevate their own privileges or create superuser accounts. Any WordPress installation using the vulnerable plugin version becomes a high-value target for lateral movement and privilege escalation attacks.

Casky.ai's 224 mapped security skills identify this vulnerability through detection of MITRE ATT&CK technique TA0004 (Privilege Escalation) patterns within WordPress environments. When Claude AI with extended reasoning analyzes this attack chain, practitioners would observe findings related to improper capability validation, insufficient authorization checks in user-facing import endpoints, and role escalation attempts that bypass WordPress's native permission model. Security teams monitoring Casky dashboards would specifically see flagged instances where low-privilege accounts interact with import functions, unauthorized role changes to administrator, and capability enforcement gaps. By mapping to MITRE's formal techniques, Casky enables practitioners to understand not just that the vulnerability exists, but how it enables real-world privilege escalation tactics and where defensive controls should be strengthened in their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92541.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-92541

Casky has 224 skills that investigate the attack patterns behind CVE-2026-92541. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn