Import and Export Users and Customers (<= 2.5.11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/import-and-export-users-and-customers--2.5.11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 10:42:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImport and export users and customers: Privilege escalation in ACUI_Cron (CVE-2026-120554)https://feed.craftedsignal.io/briefs/2026-11-wordpress-acui-privesc/Wed, 04 Nov 2026 10:42:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wordpress-acui-privesc/The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation due to a non-atomic configuration write sequence in the ACUI_Cron::save_settings() function that fails to authorize role changes before persistence.The "Import and export users and customers" plugin for WordPress (versions up to and including 2.5.11) contains a privilege escalation vulnerability. The ACUI_Cron::save_settings() function improperly persists configuration options (acui_cron_activated, acui_cron_configured_by, acui_cron_user_id, and acui_cron_path_to_file) before executing authorization checks. Authenticated users with the create_users capability can exploit this race condition to modify administrative settings and escalate their privileges to Administrator during an unattended cron task execution.

Impact

An authenticated attacker with limited capabilities (create_users) can gain full administrative access to the WordPress environment by manipulating cron settings, potentially leading to total system compromise.

Recommendation

  • Inventory WordPress installations running the "Import and export users and customers" plugin and verify the version.
  • Update the plugin to the latest version (patch for 2.5.11) as soon as the vendor provides a release.
  • If a patch is unavailable, disable the plugin or restrict access to administrative functions to trusted users only.
  • Audit user roles and capabilities to minimize users with the create_users permission.
]]>highadvisorywordpressprivilege-escalationcms