Import Export Users CVE-2026-120554

Exploitation requires an authenticated user holding a custom delegated role that grants the create_users capability but NOT promote_users or edit_users. Three concrete preconditions must also hold, per the description: (1) a prior administrator cron-tab save must already exist in the plugin's settings; (2) no successful settings save may intervene before the next cron run; and (3) an unattended cron tick must fire and process the attacker's repointed CSV file. The trigger is the non-atomic write in ACUI_Cron::save_settings(), which persists acui_cron_activated, acui_cron_configured_by, acui_cron_user_id and acui_cron_path_to_file before the authorization gate (wp_die()) rejects a non-promoter submitting a role. Limiting factors: the attacker needs valid credentials with that specific capability set, the attack is defeated if no admin cron configuration pre-exists or if any legitimate successful save occurs first, and it depends on the timing of the scheduled cron tick rather than firing on demand.

Signals are moderately consistent but not emergency-grade. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H = 8.8 High) frames this as a network-reachable, low-privilege, high-impact privilege escalation, and the vuln.today decision label is 'this_week' (Wordfence-reported) - so it warrants prompt patching but is not flagged act_now/emergency. Crucially, the description imposes real preconditions the raw CVSS AC:L does not capture: a prior administrator cron-tab save must already exist and no successful settings save may intervene before the next unattended cron tick processes the attacker's repointed CSV. Those are conditions largely outside the attacker's control, which in my view argues for higher attack complexity than the vendor's AC:L and lowers practical exploitability. No EPSS score was provided, so statistical exploitation likelihood cannot be weighed. There is no CISA KEV listing (not actively exploited per available data) and no PoC or exploit reference in the input - only plugin source lines and the fix changeset - so exploitation remains theoretical at analysis time. Net: a genuine, high-impact authorization flaw worth patching this week, but the dependency on a pre-existing admin cron configuration and a timing window makes opportunistic mass exploitation less likely than the 8.8 alone implies.

An attacker who already holds a custom WordPress role granting create_users (but not promote_users or edit_users) submits the plugin's cron settings while attempting to assign the Administrator role. Because ACUI_Cron::save_settings() persists acui_cron_activated, acui_cron_configured_by, acui_cron_user_id and acui_cron_path_to_file before the authorization check calls wp_die(), the attacker's cron configuration - pointing at a malicious CSV - is retained despite the rejection. On the next unattended cron tick (given a pre-existing admin cron save and no intervening successful save), the plugin imports the repointed CSV and escalates the attacker to Administrator. No public exploit identified at time of analysis.