| 开发者 |
carazo
hornero |
|---|---|
| 更新时间 | 2026年8月29日 07:17 |
| 捐献地址: | 去捐款 |
| PHP版本: | 5.5 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
This is caused by the option that forces the users to reset their password. When it is used, each of those users is redirected to their password page on every page load until they change it, and if that destination cannot be reached (for example, because wp-admin is blocked for customers or subscribers by WooCommerce, by a membership plugin or by a security plugin) the browser ends up in a redirection loop.
Since version 2.4.12 the plugin detects this situation and gives up after 3 consecutive redirects, so the site stays usable, but you can also clear the flag for the users that are already affected: go to the plugin documentation tab and use the button that removes the force reset password metadata from all the users.
If you want to change how many redirects are allowed before the plugin gives up, use the acui_force_reset_password_max_redirects filter (return 0 to disable the limit):
add_filter( 'acui_force_reset_password_max_redirects', function( $max ){ return 5; } );
By default they are sent to their WordPress profile page. If WooCommerce or WP User Manager are active, they are sent to the password section of the account page of those plugins instead. You can point them anywhere else using the acui_force_reset_password_edit_profile_url filter, and you can add your own exceptions (pages where the redirection must not happen) using acui_force_reset_password_redirect_condition.
The plugin natively supports CSV files. If you need to import directly from Excel (XLSX, XLS) or LibreOffice (ODS) files without converting them first, the File Formats Addon adds support for those formats.
You should fill the first two columns with the next values: Username, Email. The next columns are totally customizable and you can use whatever you want. All rows must contains same columns. User profile will be adapted to the kind of data you have selected. If you want to disable the extra profile information, please deactivate this plugin after make the import.
You can use a column called id in order to make inserts or updates of an user using the ID used by WordPress in the wp_users table. We have two different cases:
We can use a column called "Password" to manage a string that contains user passwords. We have different options for this case:
Plugin can import serialized data. You have to use the serialized string directly in the CSV cell in order the plugin will be able to understand it as an serialized data instead as any other string.
Plugin can import lists as an array. Use this separator: :: two colons, inside the cell in order to split the string in a list of items.
You can use those labels if you want to set data adapted to the WordPress default user columns (the ones who use the function wp_update_user)
You can upload as many files as you want, but all must have the same columns. If you upload another file, the columns will change to the form of last file uploaded.
You can export a file with all your users data using "Export" tab. There you will be able to find some filters and options to prepare your export.
If you want to extend this plugin or use this plugin with any other, here you have a list with all hooks available in the plugin.
Thanks, donations help us to continue improving our plugins and allow us to give the best support in the forums Donate Here via PayPal.
Of course! In Codection we help you to import, migrate, synchronized, update or any other operation you will need to do with your users. Contact us at contacto@codection.com for more information.
You can get:
Yes. Export users from your old site using the Export tab, then import the resulting CSV into your new site. Hashed passwords can be transferred using the user_pass column so users keep their existing passwords without needing to reset them.
Yes. Add WooCommerce billing and shipping fields as columns in your CSV (e.g. billing_first_name, billing_email, shipping_address_1) and the plugin will populate them automatically when importing users with the customer role.
Yes. The plugin has addons for Advanced Custom Fields, BuddyPress/BuddyBoss, Paid Membership Pro, WooCommerce Memberships, WooCommerce Subscriptions and many others. Custom meta fields not covered by an addon can still be imported by using the meta key as the column header.
By default WordPress requires an email for every user. If you need to import users without one, the Allow No Email Addon removes that requirement.
Yes. The plugin checks for existing users by username and email before inserting. If a match is found the user is updated instead of created. You can also control whether passwords and roles are overwritten on update.
Scheduled exports are available via the Recurring Export Addon. It lets you configure periodic CSV exports of your users or WooCommerce customers and send them to a file path or remote destination automatically.
Yes. The Recurring Import tab lets you configure a periodic import from a file path or URL. The plugin will fetch and process the CSV automatically at the chosen interval (hourly, daily, weekly, etc.) without any manual action. The free version supports one recurring import task. If you need multiple simultaneous scheduled imports — each with its own file, interval, role and settings — the Recurring Import Addon removes that limitation.
Yes. Point the recurring import at a URL that your external system generates and the plugin will pull and process it on every scheduled run, keeping your WordPress users in sync automatically.
You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.
acui_cron_save_settings) checked only the shared plugin nonce and, for the "User that runs the cron" field, that the selected user held the same broad menu capability (create_users by default) as whoever was saving. This let a user with create_users but not promote_users (or delete_users) select an Administrator as the execution identity, set the default role to administrator, or enable "delete users not present"/"change role of users not present", and then trigger the "Run now" no-session action, which runs the import with no logged-in user and falls back to the site's first Administrator. The promote_users check on role assignment and the missing capability checks on user deletion and role change only saw that substituted Administrator, not the actual caller, so a delegated importer could create a new Administrator account or delete/demote existing users. The Cron tab now requires promote_users to set a default role, to set the "change role of users not present" role, or to select an execution user that itself has promote_users, and requires delete_users to enable "delete users not present"acui_allowed_local_csv_base_dirs filter so a developer can whitelist extra local base folders for the CSV path (e.g. a folder an external process writes to), without disabling the underlying security check added in 2.4.3169.254.0.0/16, including the cloud metadata endpoint 169.254.169.254) and carrier-grade NAT (100.64.0.0/10, 198.18.0.0/15) hosts, and re-validates every redirect hop against the same SSRF blocklist instead of letting download_url() follow redirects unchecked. This closes the same class of Server-Side Request Forgery that was already fixed for the BuddyPress/BuddyBoss bp_avatar import in 2.4.3/3.x, but that fix had not been applied to the main CSV-by-URL import pathConference) instead of its slug (conference_member), the error now points to the right slug instead of only saying that the role does not existrole column were lowercased but compared against the role slugs as they are stored, so those roles were always rejected as non existing or invalidACUI_Helper::get_editable_roles() uses wp_roles() instead of reading the $wp_roles global directly, which could still be uninitialized in cron or front end imports, leaving the list of editable roles empty and making every role of the CSV failrole cell containing the :: list separator no longer produces a fatal error when the row is preparedhome_url() string comparison because of trailing slashes, www, https or a language prefix, an account page built with blocks or a page builder instead of the shortcode...) sent the user back and forth forever. The redirection is now skipped when the user is already on the destination URL, it does not run on AJAX, REST, cron, XML-RPC or non GET requests, and a counter stops it after 3 consecutive redirects (filterable through the new acui_force_reset_password_max_redirects hook) so the worst case is that the password change is not enforced instead of the site being unreachabletemplate_id form field was passed straight to wp_update_post() without checking the post type or current_user_can( 'edit_post' ), so a user with only the create_users capability could overwrite the title and the content of any post or page of the site (and inject arbitrary CSS through the <style> tag the email editor allows) just by changing that hidden field. The plugin now validates that the id belongs to an acui_email_template post the current user is allowed to edit, and shows a warning notice instead of saving when it does not (reported by Averon Averenkov (averonsec.com))billing_* and shipping_*) are imported again. The 2.4.9 security fix blocked every field returned by acui_restricted_fields from being saved as user meta, but that filter is public and add-ons extend it, so the 20 WooCommerce customer fields (and any field added by a third party through that filter) stopped being imported. The sensitive keys are now listed apart in ACUIHelper()->get_forbidden_meta_fields(), filterable through the new acui_forbidden_meta_fields hook, and acui_restricted_fields goes back to being only about column mappingacui_post_import_single_user, which runs after print_row_imported() has already closed the <tr>, so those cells fell outside the row and every row was two columns short. There is a new acui_row_table_extra_rows action to print cells inside the row, and the add-on now prints exactly two cells per row (one for the warnings and one for the errors) instead of one cell per messagewp_capabilities, wp_user_level, role, Username, Email) from being written as user meta during the import is now case insensitive, so a column header like WP_Capabilities cannot get through itacui_delete_attachment AJAX handler now really blocks the deletion when the attachment is not a text/csv file. The mime type check only printed a warning and then deleted the file anyway, so a user with the create_users capability could delete any attachment of the media library (images, PDFs...) and not only the CSV files the plugin manages (reported by Averon Averenkov (averonsec.com))classes/csv-uploaded.php, a leftover copy of classes/tools.php (same code, class renamed) whose GUI was never called but which still registered the acui_delete_attachment and acui_bulk_delete_attachment AJAX handlers a second timeacui_fire_cron, acui_fire_cron_no_session), remove the email attachment (acui_mail_options_remove_attachment) and send the test email (acui_send_test_email) now check current_user_can() in addition to the nonce, matching the rest of the plugin's AJAX endpoints. They were relying on the nonce alone for authorization (reported by Averon Averenkov (averonsec.com))#action_assign_post column now checks current_user_can( 'edit_post', $post_id ) before reassigning the post author, and silently skips any post id that fails the check. Previously a user with only the create_users capability could take over the authorship of any post on the site (including admin-authored ones) just by putting its id in that column (reported by Averon Averenkov (averonsec.com))update_user_meta() without an authorization check, and sensitive keys (wp_capabilities, wp_user_level, role, Username, Email) are now hard-blocked from this fallback path. Previously a user with only the create_users capability (e.g. a Shop Manager, or any role delegated CSV-import rights) could escalate their own account to Administrator by uploading a CSV with a wp_capabilities columnmaybe_update_email()) now normalizes both the stored and CSV emails with strtolower(trim()) before comparing, so a case difference (e.g. John.Doe@Example.com vs john.doe@example.com) no longer triggers a false "email changed" event, unnecessary wp_update_user() calls, or duplicate account creationcreate update-emails option), the new account's username is now derived from the row's first_name/last_name when available (e.g. JohnDoe, with JohnDoe2, JohnDoe3... on collision) instead of always falling back to an opaque duplicated_username_XXXXXX loginbp_member_type CSV column is now matched case-insensitively against the header row, consistent with how password/user_pass are already matchedbp_member_type (Profile Type) import/export column, which was previously undocumented in the in-plugin help textrole column now correctly trims leading/trailing spaces from each comma-separated value (e.g. executive_member, tracker_exclude). The previous code called array_walk( $roles_cells, 'trim' ), which is a no-op because trim() does not modify its argument by reference, so roles with a stray space (as commonly added by spreadsheet tools like Google Sheets) were silently treated as invalid and ignoredgroup_id/group_name columns) now also trims each comma-separated value before matching it against an existing group, avoiding the same issue when assigning multiple groups per usersanitize_text_field() before being stored as user meta in save_extra_user_profile_fields(), closing a stored XSS vector where a low-privileged user (e.g. Subscriber) could stash an HTML/JS payload in a custom column (reported by Luca Laytynher (LyT))esc_html() before being rendered, preventing a stored XSS payload from executing in the administrator's browser via export.js's .html() insertion (reported by Luca Laytynher (LyT))bp_avatar CSV import no longer falls back to a raw file_get_contents() call for values that are neither a numeric attachment ID nor an http(s) URL, closing an arbitrary local file read / PHP stream wrapper vector (e.g. file:///etc/passwd, php://filter) (reported by Binesh Madharapu)bp_avatar remote URL fetch now disables automatic redirect following and re-validates every redirect hop against the same SSRF blocklist used for the initial URL, preventing an attacker-hosted URL from bypassing the gate via a 3xx redirect to an internal or cloud metadata address (reported by Binesh Madharapu)bp_avatar CSV import now also rejects link-local (169.254.0.0/16), carrier-grade NAT (100.64.0.0/10, 198.18.0.0/15) and other private IP ranges after resolving the URL's host, closing the remaining part of the SSRF where wp_safe_remote_get() alone still allowed requests to the cloud metadata endpoint 169.254.169.254 (reported by Binesh Madharapu)bp_avatar CSV import now fetches remote URLs with wp_safe_remote_get() instead of file_get_contents(), preventing a Server-Side Request Forgery that let an admin-supplied URL make the server request internal hosts, cloud metadata endpoints, or scan internal ports (reported by Binesh Madharapu)path_to_file field (Tools > Import and export users and customers) now requires a local path to have a .csv extension and to resolve inside the WordPress uploads directory, closing an arbitrary file read that allowed reading server files such as /etc/hosts, logs or config files (reported by Centesiman)current_user_can('promote_users') check (plus filtering against the actor's editable roles) before applying any role during import, preventing a user with only create_users from creating or promoting an account to Administratorcurrent_user_can('edit_user', $user_id) check before the raw user_pass hash and any other wp_users core field (e.g. user_email) reach the database for an existing user during importcurrent_user_can('edit_user', $user_id) check before an existing user's email is changed via wp_update_user() when updating users by matching usernameacui_email_template_selected AJAX handler now requires edit_others_posts (filterable via acui_capability) and verifies the requested post's post_type is acui_email_template, preventing a low-privilege authenticated user (e.g. Subscriber) from using the endpoint to read the title/content of arbitrary posts, including drafts and private posts, by IDacui_refresh_enable_email_templates AJAX handlercodection-security AJAX nonce is no longer generated on admin screens the current user isn't allowed to act oncurrent_user_can('edit_user', $user_id) check before every wp_set_password() call during import, preventing a user with create_users access from resetting passwords of accounts they are not authorised to editallow_update_emails vs update_emails_existing_users)maybe_enable_wordpress_core_emails never actually re-enabling the filters, because anonymous closures cannot be removed with remove_filterignored user count is now tracked in the results array and propagated correctly across batch steps