CVE-2026-16256: POUCO Import Users Auth Bypass Flaw

CVE-2026-16256 Overview

CVE-2026-16256 affects the POUCO Import Users WordPress plugin through version 1.0.0. The plugin exposes AJAX actions to unauthenticated users without capability or nonce checks. These actions create and update WordPress accounts while trusting an attacker-supplied role value. Unauthenticated attackers can create a new administrator account and take over the site. The weakness is classified as [CWE-269] Improper Privilege Management.

Critical Impact
Unauthenticated attackers can remotely create WordPress administrator accounts and fully compromise affected sites.

Affected Products

POUCO Import Users WordPress plugin, all versions through 1.0.0

Discovery Timeline

2026-08-02 - CVE-2026-16256 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16256

Vulnerability Analysis

The POUCO Import Users plugin registers AJAX endpoints that are accessible to unauthenticated users through the wp-admin/admin-ajax.php interface. The handlers do not verify user capabilities and do not validate nonces. This gap allows any remote actor to invoke privileged account management routines without authenticating.

The endpoints also trust the role parameter supplied in the request body. An attacker can specify administrator when creating or updating a user record. The plugin then persists the account with full site privileges, granting the attacker complete control over the WordPress installation. The vulnerability carries an EPSS probability of 0.303% with a 22.573 percentile.

Root Cause

The root cause is missing authorization enforcement on privileged AJAX actions, combined with unchecked role assignment. WordPress requires plugins to gate sensitive actions with current_user_can() capability checks and to validate requests with check_ajax_referer() nonce verification. The plugin omits both controls. It further fails to restrict the role argument to a safe allowlist, treating attacker-controlled input as authoritative.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to admin-ajax.php targeting the plugin's registered wp_ajax_nopriv_ action. The request includes user attributes and sets the role to administrator. The plugin creates the account and returns a success response. The attacker then logs in with the newly created credentials and executes further actions, including theme and plugin editing, file uploads, and pivoting to the underlying host.

No verified exploit code has been published. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-16256

Indicators of Compromise

Unexpected WordPress user accounts with the administrator role in the wp_users and wp_usermeta tables
POST requests to /wp-admin/admin-ajax.php from unauthenticated sources containing a role=administrator parameter
New administrator logins from IP addresses without prior authentication history

Detection Strategies

Audit the WordPress user database for administrator accounts created after the plugin was installed
Inspect web server access logs for AJAX POST requests referencing POUCO Import Users action names
Alert on WordPress user_register events that produce administrator-level accounts outside change windows

Monitoring Recommendations

Forward WordPress audit logs and web server access logs to a centralized SIEM for correlation
Monitor for privilege escalation events tied to plugin AJAX endpoints
Track file modifications under wp-content/themes and wp-content/plugins following suspicious account creation

How to Mitigate CVE-2026-16256

Immediate Actions Required

Deactivate and remove the POUCO Import Users plugin from all WordPress installations until a patched release is available
Review the WordPress user list and delete any unrecognized administrator accounts
Rotate credentials for all legitimate administrator accounts and enforce multi-factor authentication

Patch Information

No fixed version has been published as of the last NVD update on 2026-08-05. The vulnerability affects all versions through 1.0.0. Consult the WPScan Vulnerability Report for updates on remediation availability.

Workarounds

Remove the plugin directory from wp-content/plugins to prevent AJAX handler registration
Block unauthenticated POST requests to admin-ajax.php that include a role parameter using a web application firewall rule
Restrict access to /wp-admin/ at the network edge to trusted administrative source addresses

bash

# Example WAF rule concept to block unauthenticated role assignment attempts
# ModSecurity-style pseudo rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026162560,msg:'Block unauthenticated role assignment via admin-ajax'"
  SecRule ARGS:role "@streq administrator" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"