{"id":"CVE-2026-120554","kind":"vulnerability","aliases":["CVE-2026-120554"],"related":[],"title":"WordPress import/export users plugin lets delegated roles escalate to Administrator","description":"The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.","summary":"The Import and export users and customers plugin for WordPress, up to and including 2.5.11, writes cron settings before its authorization check runs. An authenticated user with a delegated role that has create_users but not promote_users or edit_users can use this to become an Administrator, if an administrator has already saved the cron settings.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"import-users-from-csv-with-meta","fixed":["2.5.12"],"affected":"<= 2.5.11","ecosystem":"wordpress"}],"ecosystems":[],"tags":["import-export-users","package","wordpress","wp-plugin"],"not_affected_if":["no-cron-settings-saved","no-custom-delegated-roles","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: 'Import and export users and customers' (slug import-users-from-csv-with-meta) at 2.5.11 or lower is affected; 2.5.12 is the patched version per Wordfence.\n- CLI: wp plugin get import-users-from-csv-with-meta --field=version\n- Exposure needs an administrator to have saved the cron settings (check wp option get acui_cron_activated) and a custom role holding create_users without promote_users or edit_users (wp role list; wp cap list <role>).","fix":"Update the Import and export users and customers plugin to 2.5.12 or later (Wordfence lists 2.5.12 as the patched version).","status":"open","published_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:07+00:00","updated_at":"2026-11-04T10:28:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T10:27:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress import/export users plugin lets delegated roles escalate to Administrator","impact":"high","summary":"The Import and export users and customers plugin for WordPress, up to and including 2.5.11, writes cron settings before its authorization check runs. An authenticated user with a delegated role that has create_users but not promote_users or edit_users can use this to become an Administrator, if an administrator has already saved the cron settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","import-export-users"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains Administrator rights on the WordPress site","analyst_note":"Check the plugin vendor or NVD page for a fixed version after 2.5.11 and confirm the affected range.","how_to_check":"- Check the installed version of the 'Import and export users and customers' plugin in the WordPress admin plugin list; a version of `2.5.11` or lower is in the affected range.\n- Review custom roles that hold `create_users` without `promote_users` or `edit_users`.\n- unknown for any other check, the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-custom-delegated-roles","no-cron-settings-saved"],"who_is_affected":"Sites running the Import and export users and customers plugin at version 2.5.11 or lower, where some users hold a custom role with create_users but not promote_users or edit_users. The exploit also needs a prior administrator cron-tab save and a CSV path the attacker can repoint before the next cron run. Sites without the plugin, or with the plugin updated past the affected range, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4304,"output_tokens":642,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the plugin vendor or NVD page for a fixed version after 2.5.11 and confirm the affected range.","search":"'-120554':13A,16A '-2026':12A,15A '2.5.11':47B,112C 'activ':137C 'acui':128C,135C,138C,142C,147C 'administr':10A,80B,83B,196C,200C 'alreadi':85B 'atom':120C 'attack':175C,219C 'authent':57B,174C 'author':53B,155C 'becom':78B 'call':158C 'check':54B 'configur':140C 'creat':65B,182C 'cron':49B,88B,129C,136C,139C,143C,148C,202C,215C 'cron-tab':201C 'csv':21A,222C 'custom':39B,96C,178C 'cve':11A,14A 'deleg':6A,61B,179C 'die':160C 'due':115C 'edit':72B,189C 'escal':8A,104C,192C 'exist':205C 'export':26B,36B,93C 'file':151C,223C 'from':20A 'function':132C 'gate':156C 'hold':176C 'id':145C 'import':18A,25B,34B,91C 'import-export-us':24B 'import-users-from-csv-with-meta':17A 'import/export':2A 'includ':46B,111C 'interven':210C 'let':5A 'make':170C 'meta':23A 'multi':122C 'multi-opt':121C 'next':213C 'non':119C,164C 'non-atom':118C 'non-promot':163C 'option':123C 'packag':28B 'path':149C 'persist':134C 'plugin':4A,32B,40B,97C 'possibl':172C 'prior':199C 'privileg':103C,194C 'process':217C 'promot':69B,165C,186C 'provid':197C 'reach':153C 'repoint':221C 'role':7A,62B,168C,180C 'run':55B 'save':86B,130C,204C,209C 'sequenc':125C 'set':50B,89B,131C 'submit':166C 'success':208C 'tab':203C 'tick':216C 'unattend':214C 'use':75B 'user':3A,27B,37B,58B,66B,70B,73B,94C,144C,183C,187C,190C 'users':19A 'version':107C 'vulner':101C 'with':22A 'without':185C 'wordpress':1A,29B,42B,99C 'wp':31B,159C 'wp-plugin':30B 'write':48B,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Import and export users and customers plugin at version 2.5.11 or lower, where some users hold a custom role with create_users but not promote_users or edit_users. The exploit also needs a prior administrator cron-tab save and a CSV path the attacker can repoint before the next cron run. Sites without the plugin, or with the plugin updated past the affected range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["importusersfromcsvwithmeta"],"ptokens":["csv","from","import","meta","users","with"],"labels":["high","importexportusers","package","wordpress","wpplugin"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120554","severity":null,"published_at":"2026-11-04T10:17:26+00:00","modified_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120554:1656","url":null,"severity":null,"published_at":"2026-11-04T10:28:19+00:00","modified_at":"2026-11-04T10:28:19+00:00","first_seen_at":"2026-11-04T10:28:19+00:00","fetched_at":"2026-11-04T10:28:19+00:00","note":"Wordfence (CNA, third-party tracker, not the maintainer) gives affected <=2.5.11, patched 2.5.12. No maintainer changelog/trac page read, so nothing marked verified. No exploitation or PoC found. Not checked X/HN."}],"documents":[{"id":66154,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-users-from-csv-with-meta/import-and-export-users-and-customers-2511-authenticated-custom-privilege-escalation-via-non-atomic-cron-settings-save","title":"Wordfence: Import and export users and customers <= 2.5.11 Privilege Escalation via Non-Atomic Cron Settings Save","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":66157,"url":"https://wordpress.org/plugins/import-users-from-csv-with-meta/","title":"Import and export users and customers - WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}