Administrator takeover via unchecked CSV import authorization

Privilege escalation in Javier Carazo Import and export users and customers before 2.4.2 allows remote authenticated users to become Administrators. The acui_import_users_batch path applies CSV role and wp_users fields without checking promote_users or edit_user for the target account. An account with only read and create_users can create a new Administrator or replace an existing Administrator's password or email.