CVE-2026-16534
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The 'Import and export users and customers' WordPress plugin before version 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Risk Assessment
An attacker can gain full control over the WordPress site by creating an administrator account or modifying an existing administrator's data.
Recommendation
Update the plugin to version 2.4.2 or later, which enforces proper permission checks.
Original NVD description (English source)
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.