Unauthorized Account Management in WordPress User Import Plugin
CVE-2026-16534
Currently unrated
What is CVE-2026-16534?
The Import and Export Users and Customers plugin for WordPress before version 2.4.2 lacks proper enforcement of role-assignment and per-user edit permissions during CSV imports. This oversight allows a user with only basic user-creation rights to not only create a new administrator account but also to overwrite the passwords or emails of existing administrators, posing a significant security risk.
Affected Version(s)
Import and export users and customers 0 < 2.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.