{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/import-and-export-users-and-customers--2.5.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:import_and_export_users_and_customers_project:import_and_export_users_and_customers:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-120554"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-120554\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Import and export users and customers (\u003c= 2.5.11)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","cms"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe \u0026quot;Import and export users and customers\u0026quot; plugin for WordPress (versions up to and including 2.5.11) contains a privilege escalation vulnerability. The \u003ccode\u003eACUI_Cron::save_settings()\u003c/code\u003e function improperly persists configuration options (\u003ccode\u003eacui_cron_activated\u003c/code\u003e, \u003ccode\u003eacui_cron_configured_by\u003c/code\u003e, \u003ccode\u003eacui_cron_user_id\u003c/code\u003e, and \u003ccode\u003eacui_cron_path_to_file\u003c/code\u003e) before executing authorization checks. Authenticated users with the \u003ccode\u003ecreate_users\u003c/code\u003e capability can exploit this race condition to modify administrative settings and escalate their privileges to Administrator during an unattended cron task execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated attacker with limited capabilities (\u003ccode\u003ecreate_users\u003c/code\u003e) can gain full administrative access to the WordPress environment by manipulating cron settings, potentially leading to total system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory WordPress installations running the \u0026quot;Import and export users and customers\u0026quot; plugin and verify the version.\u003c/li\u003e\n\u003cli\u003eUpdate the plugin to the latest version (patch for 2.5.11) as soon as the vendor provides a release.\u003c/li\u003e\n\u003cli\u003eIf a patch is unavailable, disable the plugin or restrict access to administrative functions to trusted users only.\u003c/li\u003e\n\u003cli\u003eAudit user roles and capabilities to minimize users with the \u003ccode\u003ecreate_users\u003c/code\u003e permission.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T12:00:40Z","date_published":"2026-11-04T10:42:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wordpress-acui-privesc/","summary":"The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation due to a non-atomic configuration write sequence in the ACUI_Cron::save_settings() function that fails to authorize role changes before persistence.","title":"Import and export users and customers: Privilege escalation in ACUI_Cron (CVE-2026-120554)","url":"https://feed.craftedsignal.io/briefs/2026-11-wordpress-acui-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Import and Export Users and Customers (\u003c= 2.5.11)","version":"https://jsonfeed.org/version/1.1"}