critical9.8
CVE-2026-16256
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that c…
Impact
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
Affected products
| Product | Affected versions |
|---|---|
| POUCO Import Users WordPress Plugin | through 1.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.