CVE-2026-16256 in POUCO Import Users Plugin
Summary
by MITRE • 08/02/2026
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
The POUCO Import Users WordPress plugin version 1.0.0 contains a critical security vulnerability that stems from inadequate authentication and authorization controls within its AJAX endpoint implementation. This flaw represents a classic example of insufficient privilege validation where the plugin fails to enforce proper capability checks or nonce verification before executing user account creation and modification operations. The vulnerability exists because the plugin exposes AJAX actions that should require authenticated access but instead accepts requests from any unauthenticated user, creating an entry point for malicious actors to escalate their privileges within the WordPress environment.
The technical implementation of this vulnerability involves the plugin's failure to validate user capabilities or verify nonce tokens before processing AJAX requests related to user management. Additionally, the plugin directly trusts and applies role values provided by attackers through the request parameters without proper validation or sanitization. This trust-based approach allows malicious users to supply administrator-level role values in their requests, bypassing WordPress's normal user role assignment controls that would typically require elevated privileges to assign such roles. The combination of missing authentication checks and blind trust in attacker-supplied data creates a path for privilege escalation that directly violates security principles outlined in the CWE (Common Weakness Enumeration) classification for insufficient validation of untrusted data.
The operational impact of this vulnerability is severe and potentially catastrophic for affected WordPress installations. An unauthenticated attacker can leverage this flaw to create entirely new administrator accounts with full control over the site, effectively compromising the entire WordPress environment. This attack vector allows for complete site takeover including but not limited to content manipulation, user data theft, malware installation, and potential lateral movement within network infrastructure if the compromised WordPress instance serves as a foothold for further attacks. The vulnerability's impact aligns with ATT&CK techniques related to privilege escalation and initial access through vulnerable web applications, making it particularly dangerous in environments where WordPress is used as a primary content management system.
Mitigation strategies should focus on immediate plugin updates or complete removal from affected systems, followed by comprehensive security auditing of the WordPress installation. Organizations should implement proper input validation and sanitization measures to prevent similar issues in custom code implementations, ensuring that all AJAX endpoints verify user capabilities and validate nonce tokens before processing sensitive operations. The vulnerability demonstrates the critical importance of following secure coding practices as outlined in OWASP Top Ten and NIST cybersecurity guidelines, particularly regarding authentication controls and data validation. System administrators should also consider implementing web application firewalls to detect and block suspicious AJAX requests targeting known vulnerable endpoints, while maintaining regular security monitoring to identify potential exploitation attempts.