CVE-2026-16534: WordPress Plugin Auth Bypass Vulnerability

CVE-2026-16534 Overview

CVE-2026-16534 is a privilege escalation vulnerability in the Import and export users and customers WordPress plugin before version 2.4.2. The plugin fails to enforce WordPress role-assignment and per-user edit permissions during CSV import. A user holding only the user-creation capability can create an administrator account. The same flaw allows overwriting an existing administrator's password or email address through crafted CSV data. The weakness is tracked under CWE-269: Improper Privilege Management.

Critical Impact
A low-privilege user with the user-creation capability can escalate to administrator and take over existing administrator accounts by importing a crafted CSV file.

Affected Products

Import and export users and customers WordPress plugin versions prior to 2.4.2
WordPress sites using the plugin for bulk user provisioning
WooCommerce deployments relying on the plugin for customer imports

Discovery Timeline

2026-08-03 - CVE-2026-16534 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16534

Vulnerability Analysis

The vulnerability resides in the CSV import handler of the Import and export users and customers plugin. WordPress ships with two distinct authorization checks that must gate any user modification. The promote_users capability governs role assignment, and the edit_user meta-capability governs per-user edits. The plugin invokes its import routine using only a broader user-creation capability check.

As a result, the import logic accepts arbitrary role values in CSV rows without validating that the acting user is permitted to assign them. It also accepts arbitrary user_login or ID fields that reference existing accounts, allowing overwrite of higher-privileged users. Fields such as user_pass and user_email in the CSV replace the stored values for the target account.

An attacker who has been granted the user-creation capability, for example through a custom role or a delegated administrative task, can submit a CSV that either creates a new user with the administrator role or updates an existing administrator's credentials. The result is full site takeover.

Root Cause

The root cause is missing authorization enforcement in the import workflow. The plugin does not call current_user_can( 'promote_users' ) before role assignment and does not call current_user_can( 'edit_user', $target_id ) before modifying an existing account. This constitutes improper privilege management under [CWE-269].

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session holding the user-creation capability. The attacker uploads a CSV containing rows that either set role=administrator on a new account or target an existing administrator's user_login with attacker-controlled user_pass and user_email values. No user interaction from another party is required.

See the WPScan Vulnerability Report for the disclosure record.

Detection Methods for CVE-2026-16534

Indicators of Compromise

Unexpected user accounts with the administrator role created shortly after a CSV import event.
Password or email changes on existing administrator accounts without a corresponding password-reset workflow entry.
HTTP POST requests to the plugin's import endpoint originating from non-administrator sessions.
New administrator logins from IP addresses not previously associated with privileged users.

Detection Strategies

Audit the wp_users and wp_usermeta tables for role changes and email or password modifications correlated with plugin import timestamps.
Enable WordPress activity logging plugins to record user creation, role promotion, and profile update events with the acting user's ID.
Compare the list of accounts with administrator capability against an approved baseline on a scheduled cadence.

Monitoring Recommendations

Alert on any invocation of the plugin's CSV import handler by users whose role is below administrator.
Monitor web server logs for POST requests referencing the plugin's import action and correlate them with the authenticated user identifier.
Track outbound authentication notification emails to detect password resets that bypass the standard reset flow.

How to Mitigate CVE-2026-16534

Immediate Actions Required

Update the Import and export users and customers plugin to version 2.4.2 or later.
Review all accounts holding the user-creation capability and revoke it from roles that do not require it.
Audit administrator accounts for unauthorized creation, password changes, or email changes since the plugin was installed.
Force a password reset for all administrator accounts if compromise is suspected.

Patch Information

The plugin vendor addressed the flaw in version 2.4.2 by enforcing the promote_users capability during role assignment and the edit_user meta-capability during modification of existing accounts. Refer to the WPScan Vulnerability Report for the fixed-version reference.

Workarounds

Deactivate the Import and export users and customers plugin until the upgrade to 2.4.2 is completed.
Restrict the plugin's import page to administrator roles only using a web server access control rule or a role-management plugin.
Remove custom roles that grant the user-creation capability without also granting full administrative trust.

bash

# Example: restrict the plugin admin page to administrators at the web server layer
# Nginx location block that blocks access to the plugin's import endpoint
location ~* /wp-admin/admin\.php {
    if ($arg_page = acui) {
        # Require an admin session cookie check via auth_request or similar
        return 403;
    }
}