Privilege Escalation Vulnerability in WordPress Import Users from CSV Plugin

CVE-2026-120554

What is CVE-2026-120554?

The Import Users from CSV with Meta plugin for WordPress contains a vulnerability that allows authenticated attackers with custom roles to escalate their privileges to Administrator. This vulnerability arises from a non-atomic multi-option write sequence in the settings save function, which processes critical settings before proper authorization checks are made. If an attacker's specified CSV file is processed during an unattended cron job, it can lead to unauthorized privilege escalation, compromising the security of the site.

References