Import and export users and customers WordPress plugin vulnerabilities

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11. This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists certain options before reaching the authorization gate, making it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality. This allows users with only the create_users capability to change the role of existing users, including promoting them to administrator.

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import. This allows users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

The Import and export users and customers WordPress plugin before version 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.