rootpwn

high · CVSS v3 7.2 · EPSS 0.00132

CVE-2026-92540

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users cap…

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
—
EPSS
0.00132

← All CVEs

Related CVEs

high

CVE-2026-93974

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-87839

The Tripzzy WordPress plugin (v<1.5.1) lacks authorization checks on an AJAX endpoint, letting unauthenticated users delete any comment. This flaw can erase user-generated content and disrupt site integrity. It is a high‑severity vulnerability that can be exploited without credentials.

View analysis

high

CVE-2026-92252

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This may disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated WatchDog process.

View analysis

high

CVE-2026-92253

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file path and persuading an administrator to restore the file. This may enable modification of protected files or SYSTEM-level code execution through DLL hijacking.

View analysis