CVE Alert: CVE-2026-120554 – carazo

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the unattended cron tick processes the attacker’s repointed CSV file.

**Risk verdict:** High-impact but conditional privilege escalation; act promptly on exposed sites, although the supplied SSVC state reports no exploitation and KEV/EPSS data is unavailable.

**Why this matters:** A successful attack can grant site-administrator control, enabling access to user data, malicious account creation, content changes or further compromise of the hosting environment. The attack requires a specific existing cron configuration and timing window, so exposure is narrower than the impact suggests; current exploitation likelihood cannot be assessed without KEV and EPSS status.

**Most likely attack path:** A network attacker needs an authenticated account with delegated user-creation rights, but not user-promotion or editing rights; no victim interaction is required. They exploit the settings-write sequence, then rely on an unattended cron run to process a redirected CSV, provided an administrator previously saved cron settings and no later successful save supersedes the setup. Scope remains within the affected site, though administrator access may enable further activity there.

**Who is most exposed:** WordPress sites using user/customer CSV imports, especially those with scheduled imports and custom roles for delegated account management.

Review authentication and audit logs for unusual activity by delegated accounts.

Check cron configuration and import-file paths for unexpected changes.

Correlate scheduled imports with unexpected administrator creation or role changes.

Inspect imported CSVs and recent user records for unapproved accounts.

Mitigation and prioritisation

Confirm the vendor-fixed release and upgrade promptly; no fixed version is specified in the supplied data.

Until patched, disable scheduled imports or the plugin where operationally feasible.

Remove unnecessary `create_users` access and restrict plugin settings to trusted administrators.

Audit cron settings, import paths and administrator accounts; preserve evidence before cleanup.

Test changes in staging, then verify scheduled imports remain correctly authorised.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.