CVE-2026-120554highCWE-863

CVE-2026-120554: fallo de gravedad alta en carazo Import and export users and customers

Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

Publicada el

Seguir esta CVE+ Monitorear Import and export users and customers

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.6%
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
carazo · Import and export users and customers
CVEs relacionadas — carazo Import and export users and customers

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6583MEDIUMImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import FunctionalityEPSS 0.8%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2026-86583HIGHImport and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile FieldsEPSS 0.5%CVE-2026-3629HIGHImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.4%CVE-2024-1050MEDIUMImport and export users and customers <= 1.26.5 - Missing AuthorizationEPSS 0.4%CVE-2026-15026MEDIUMImport and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX ActionEPSS 0.4%