CVE-2026-120554
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11. This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists certain options before reaching the authorization gate, making it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
Risk Assessment
An attacker can elevate privileges to administrator level, leading to full control over the WordPress site and potential data compromise.
Recommendation
Update the plugin to a version later than 2.5.11 if available, or restrict delegated roles and monitor for unusual privilege changes.
Other vulnerabilities in Import and export users and customers WordPress plugin
See all- CVE-2026-92541High
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality. This allows users with only the create_users capability to change the role of existing users, including promoting them to administrator.
- CVE-2026-92540High
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import. This allows users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
- CVE-2026-16542Medium
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
- CVE-2025-15673Medium
The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Original NVD description (English source)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS