CVE-2026-120554 in Import and Export Users and Customers Plugin
Summary
by MITRE • 11/04/2026
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The Import and export users and customers plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 2.5.11, classified under CWE-862 as Missing Authorization. This flaw stems from a non-atomic multi-option write sequence within the ACUI_Cron::save_settings() function. The core technical issue lies in the order of operations during configuration updates, where sensitive state variables are persisted to the database before an authorization check is performed. Specifically, the plugin writes values for acui_cron_activated, acui_cron_configured_by, acui_cron_user_id, and acui_cron_path_to_file prior to validating whether the submitting user possesses the necessary permissions to modify these settings. This architectural oversight creates a race condition window where unauthorized state changes can be committed if subsequent validation fails or is bypassed through specific timing conditions.
The operational impact of this vulnerability allows authenticated attackers with limited privileges to escalate their rights to Administrator level. To exploit this flaw, an attacker must hold a custom delegated role that includes the create_users capability but lacks promote_users or edit_users capabilities. The exploitation requires precise environmental conditions: there must be a prior administrator cron-tab save event in place, and no successful configuration save can intervene between the initial state setup and the attacker's action. When these conditions are met, an unattended cron tick processes the attacker's repointed CSV file path. Because the plugin has already persisted the malicious configuration data before checking if the user is authorized to promote users or edit existing ones, the system accepts the new settings effectively granting administrative control over user import and export operations.
This vulnerability aligns with ATT&CK technique T1078, Valid Accounts, as it relies on pre-existing authenticated access, and T1546.003, Scheduled Task/Job: Event Triggered Execution, due to the reliance on WordPress cron jobs for execution timing. The lack of atomicity in database writes is a common pattern in legacy web applications where performance optimizations inadvertently compromise security boundaries by separating state persistence from authorization enforcement. Attackers can leverage this to manipulate user data, potentially leading to further compromises such as unauthorized access to sensitive customer information or complete site takeover if combined with other vectors.
Mitigation strategies should prioritize immediate patching to the latest version of the plugin once available, ensuring that all security patches addressing privilege escalation are applied promptly. In environments where upgrading is not immediately feasible, administrators should restrict user roles by removing the create_users capability from any custom delegated roles until the vulnerability is resolved. Additionally, implementing strict input validation and moving authorization checks before any database write operations can prevent similar issues in future development cycles. Security monitoring tools should be configured to detect unusual spikes in cron job executions or unexpected changes to user role assignments, which may indicate exploitation attempts of this specific race condition. Regular audits of custom WordPress roles against the principle of least privilege are essential to minimize the attack surface for such escalation paths.