POUCO Import Users CVE-2026-16256

The only prerequisite is that a target WordPress site has the POUCO Import Users plugin (version ≤1.0.0) installed and active - no authentication, no user interaction, and no non-default configuration are required, matching the AV:N/AC:L/PR:N/UI:N vector. Exploitation works against default plugin settings because the vulnerable unauthenticated AJAX handlers for creating/updating accounts and the trusted attacker-supplied role value are core plugin behavior. The main limiting factor is deployment footprint: only sites that have this specific, apparently low-install plugin are exposed; sites without it are not affected regardless of WordPress core version.

Multiple signals converge on high real-world severity: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability impact, and publicly available exploit code exists. Administrator takeover is essentially total site compromise, so technical impact is total and the attack is highly automatable. The one tempering signal is EPSS at 0.15% (5th percentile), which reflects low currently-observed exploitation volume rather than low exploitability - consistent with a niche, likely low-install plugin rather than a difficult exploit. It is NOT on CISA KEV, so there is no confirmed active exploitation. Net: this is a genuine critical-priority issue for any site running the plugin, despite the modest EPSS number, because the barrier to exploitation is essentially zero once the plugin is installed.

An attacker scans for sites running the POUCO Import Users plugin and sends a crafted unauthenticated POST to wp-admin/admin-ajax.php invoking the plugin's user-creation action with a chosen username, password, and role=administrator. Because no capability or nonce check is enforced and the role value is trusted, a new administrator account is created; the attacker logs in and gains full control to install backdoors or deface/exfiltrate. Publicly available exploit code lowers the effort required to a simple scripted request.