CVE-2026-120554: Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUICron::savesettings() function, which persists acuicronactivated, acuicronconfiguredby, acuicronuserid, and acuicronpathtofile before reaching the authorization gate that calls wpdie() when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with createusers but without promoteusers or editusers to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An attacker must be authenticated and hold a custom delegated role with the create_users capability, while lacking promote_users or edit_users. The attack also depends on a prior administrator save of the plugin's cron-tab settings.
What timing and configuration conditions are required for exploitation?
The attacker must repoint the CSV file after the relevant settings have been written but before the authorization check stops the request. No successful cron-settings save can occur before the next unattended cron tick, which must then process the attacker-controlled CSV file.
Are default WordPress roles sufficient to exploit the vulnerability?
The described attack requires a custom delegated role with create_users but without promote_users or edit_users. The provided information does not state that any default WordPress role has this specific capability combination.
How can administrators reduce exposure if they cannot immediately update?
Prevent untrusted accounts from using roles that grant create_users without promote_users or edit_users, and review access to the plugin's cron settings. Avoid leaving a window for unattended cron processing after any suspected settings manipulation.