The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 2.5.11. A non‑atomic write sequence in the ACUI_Cron::save_settings() function persists several cron options before an authorization check runs. This allows an authenticated user who has the create_users capability, but lacks promote_users or edit_users, to modify cron configuration. If a prior administrator has saved a cron template and no other successful save occurs before the next unattended cron tick, the attacker can trigger the repointed CSV file and elevate their access to Administrator.

This flaw affects the WordPress plugin Import and export users and customers provided by carazo, for every version through and including 2.5.11. No other vendors or products are known to be impacted.

The CVSS score of 8.8 indicates a high severity vulnerability. No EPSS score is available, and the issue is not listed in CISA's KEV catalog. The attack requires an authenticated user with a delegated role that includes create_users but not promote_users or edit_users, and an existing administrator crontab configuration that remains unchanged until exploitation. The scenario is a server‑side attack that depends on the unattended cron process. While no publicly documented exploit currently exists, the impact of successful exploitation is full administrative control over the WordPress site.