CVE-2026-16534 in Import and export users and customers Plugin

Summary

by MITRE • 08/03/2026

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsible: WPScan
• Reservation: 07/22/2026
• Disclosure: 08/03/2026
• Moderation: accepted
• Entry: VDB-385518
• CPE: ready
• CWE: CWE-269 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-16534
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16534
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-16534/