CVE-2026-16256
Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
| Vendor | unknown |
| Product | pouco import users |
| Published | Aug 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown pouco import users
Be the first to know when new unknown vulnerabilities affecting unknown pouco import users are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / POUCO Import Users
0 ≤ 1.0.0
References
Credits
Khaled Alenazi (Nxploited) WPScan