Read the docs
TI-2026-85003 Aliases CVE-2026-120554GHSA-63fg-ffv3-2xr7

Import and export users and customers: Privilege Escalation via Cron Save

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The plugin is vulnerable to privilege escalation in all versions up to and including 2.5.11. ACUI_Cron::save_settings() writes four acui_cron options before its authorization check, which calls wp_die() when a non-promoter submits a role. An authenticated attacker with a custom delegated role holding create_users, but not promote_users or edit_users, can become Administrator if an administrator saved the cron settings earlier and no successful save follows before the next unattended cron tick processes the attacker's repointed CSV file. The weakness is CWE-863.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
carazoImport and export users and customersup to 2.5.11—No fix listedCNA
  • Import and export users and customers Vendorcarazo Affected up to 2.5.11 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for this plugin, so all versions through 2.5.11 remain affected. Remove or restrict custom delegated roles that hold create_users, and review the ACUI cron settings for CSV file paths that non-administrators may have changed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-120554
  2. 2026-11-04 Alias added: GHSA-63fg-ffv3-2xr7
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW
  5. 2026-11-05 Priority changed: LOW → MEDIUM

References

Other 8

  • TI-2026-59231 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege… CVSS 3.1HIGH 8.8
  • TI-2026-06723 Improper privilege management in carazo Import and export users and customers CVSS 3.1HIGH 8.8
  • TI-2026-03129 Improper privilege management in carazo Import and export users and customers CVSS 3.1HIGH 8.1
  • TI-2026-74595 Stored cross-site scripting in Import and export users and customers CVSS 3.1MEDIUM 6.4
  • TI-2026-12647 Missing authorization in carazo Import and export users and customers CVSS 3.1MEDIUM 4.3
  • TI-2024-04407 Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences