CVE-2026-16256
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The POUCO Import Users WordPress plugin through version 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value. This allows unauthenticated attackers to create a new administrator account and take over the site.
Risk Assessment
An unauthenticated attacker can easily create an administrator account and gain full control over the site.
Recommendation
Immediately disable or remove the POUCO Import Users plugin until a patch is released.
Original NVD description (English source)
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.