---
id: "CVE-2026-120554"
kind: "vulnerability"
aliases: ["CVE-2026-120554"]
title: "WordPress import/export users plugin lets delegated roles escalate to Administrator"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "import-users-from-csv-with-meta", "fixed": ["2.5.12"], "affected": "<= 2.5.11", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["import-export-users", "package", "wordpress", "wp-plugin"]
not_affected_if: ["no-cron-settings-saved", "no-custom-delegated-roles", "plugin-not-installed"]
published_at: "2026-11-04T10:17:26+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:28:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120554", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:28:19+00:00"}]
---

# WordPress import/export users plugin lets delegated roles escalate to Administrator

The Import and export users and customers plugin for WordPress, up to and including 2.5.11, writes cron settings before its authorization check runs. An authenticated user with a delegated role that has create_users but not promote_users or edit_users can use this to become an Administrator, if an administrator has already saved the cron settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:import-users-from-csv-with-meta affected <= 2.5.11 fixed 2.5.12

## How to check

- WordPress admin > Plugins: 'Import and export users and customers' (slug import-users-from-csv-with-meta) at 2.5.11 or lower is affected; 2.5.12 is the patched version per Wordfence.
- CLI: wp plugin get import-users-from-csv-with-meta --field=version
- Exposure needs an administrator to have saved the cron settings (check wp option get acui_cron_activated) and a custom role holding create_users without promote_users or edit_users (wp role list; wp cap list <role>).

## Fix

Update the Import and export users and customers plugin to 2.5.12 or later (Wordfence lists 2.5.12 as the patched version).

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120554
- 2026-11-04T10:28:19+00:00 analyst — Wordfence (CNA, third-party tracker, not the maintainer) gives affected <=2.5.11, patched 2.5.12. No maintainer changelog/trac page read, so nothing marked verified. No exploitation or PoC found. Not checked X/HN.

## Documents

- [advisory] Wordfence: Import and export users and customers <= 2.5.11 Privilege Escalation via Non-Atomic Cron Settings Save https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/import-users-from-csv-with-meta/import-and-export-users-and-customers-2511-authenticated-custom-privilege-escalation-via-non-atomic-cron-settings-save
- [mentions] Import and export users and customers - WordPress.org plugin page https://wordpress.org/plugins/import-users-from-csv-with-meta/

## From the sources

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_