CVE-2026-16256 — Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update W…
Published: 2026-08-02 · CVSS: 9.8 · CVSS 3.1
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7