IMPORT-USERS-FROM-CSV-WITH-META · CVE-2026-120554 · Package
FIX → 2.5.12
The Import and export users and customers plugin for WordPress, up to and including 2.5.11, writes cron settings before its authorization check runs. An authenticated user with a delegated role that has create_users but not promote_users or edit_users can use this to become an Administrator, if an administrator has already saved the cron settings.
first public Nov 4, 2026 · 2 sources
Running Import-users-from-csv-with-meta? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Import and export users and customers plugin at version 2.5.11 or lower, where some users hold a custom role with create_users but not promote_users or edit_users. The exploit also needs a prior administrator cron-tab save and a CSV path the attacker can repoint before the next cron run. Sites without the plugin, or with the plugin updated past the affected range, can skip it.
Not affected if no-cron-settings-saved, no-custom-delegated-roles, plugin-not-installed
Who cares import-export-users, wordpress, wp-plugin
Upgrade to 2.5.12
Update the Import and export users and customers plugin to 2.5.12 or later (Wordfence lists as the patched version).
2.5.12The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the ACUI_Cron::save_settings() function, which persists acui_cron_activated, acui_cron_configured_by, acui_cron_user_id, and acui_cron_path_to_file before reaching the authorization gate that calls wp_die() when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with create_users but without promote_users or edit_users to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
This page as .md · .json · in your agent: get_signal("CVE-2026-120554") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.