Skip to content
Threat Feed
Subscribe
high advisory PoC

Import and export users and customers: Privilege escalation in ACUI_Cron (CVE-2026-120554)

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation due to a non-atomic configuration write sequence in the ACUI_Cron::save_settings() function that fails to authorize role changes before persistence.

CVE search metadata

CVE search record: CVE-2026-120554. Severity: high. CVSS: 8.8. KEV: no. Product: Import and export users and customers (<= 2.5.11). Brief: Import and export users and customers: Privilege escalation in ACUI_Cron (CVE-2026-120554). Brief link: https://feed.craftedsignal.io/briefs/2026-11-wordpress-acui-privesc/

Triage facts

Revision 2
Applicability
Import and export users and customers (<= 2.5.11)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 2Nov 4, 12:01 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

The "Import and export users and customers" plugin for WordPress (versions up to and including 2.5.11) contains a privilege escalation vulnerability. The ACUI_Cron::save_settings() function improperly persists configuration options (acui_cron_activated, acui_cron_configured_by, acui_cron_user_id, and acui_cron_path_to_file) before executing authorization checks. Authenticated users with the create_users capability can exploit this race condition to modify administrative settings and escalate their privileges to Administrator during an unattended cron task execution.

Impact

An authenticated attacker with limited capabilities (create_users) can gain full administrative access to the WordPress environment by manipulating cron settings, potentially leading to total system compromise.

Recommendation

  • Inventory WordPress installations running the "Import and export users and customers" plugin and verify the version.
  • Update the plugin to the latest version (patch for 2.5.11) as soon as the vendor provides a release.
  • If a patch is unavailable, disable the plugin or restrict access to administrative functions to trusted users only.
  • Audit user roles and capabilities to minimize users with the create_users permission.

Immediate actions

Inventory all WordPress instances and identify versions of the Import and export users and customers plugin.

IT Operations 24h

Threat Hunt

Monitor for suspicious modifications to WordPress options or cron job settings by users with delegated roles (create_users capability).

T1068 high medium confidence hunt now

Data: WordPress database update logs, WordPress plugin activity logs

Mitigations

Update the Import and export users and customers plugin to the latest secure version once available.

immediate IT Operations

CVE-2026-120554