CVE-2026-120554 Details
Description
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
A privilege escalation vulnerability has been identified in the Import and Export Users and Customers plugin for WordPress, affecting all versions through 2.5.11. The issue arises from a non-atomic multi-option write sequence in the 'ACUI_Cron::save_settings()' function. This sequence persists several cron-related settings before passing through the authorization gate, which could prevent unauthorized role changes. As a result, authenticated attackers with a custom delegated role that includes 'create_users' but lacks 'promote_users' or 'edit_users' can escalate their privileges to Administrator. This exploitation requires a prior administrator cron-tab save and the absence of successful saves before the next unattended cron tick processes the attacker's modified CSV file.
Users are advised to update the Import and Export Users and Customers plugin to version 2.5.12 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Import and export users and customers | <= 2.5.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |