What is the CVSS score of CVE-2026-16534?

CVE-2026-16534 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Import and Export Users and Customers are affected by CVE-2026-16534?

The 'Import and Export Users and Customers' WordPress plugin versions prior to 2.4.2 contain a critical privilege escalation vulnerability that allows users with basic account-creation permissions to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16534?

Yes, a public proof-of-concept exploit is available for CVE-2026-16534. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16534?

Within 24 hours, identify all WordPress instances running the affected plugin and document current versions and user permission assignments. Within 7 days, apply vendor patch to version 2.4.2 or later on all affected installations and restrict the user-creation capability to senior administrators only. Within 30 days, audit all administrator accounts for unauthorized creations, verify administrator email addresses and password integrity, and review CSV import activity logs for suspicious entries.

Import and Export Users and Customers CVE-2026-16534

EUVD-2026-52166 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-03 WPScan

GHSA-xw98-5fp3-v7vg

WordPress Privilege Escalation Import And Export Users And Customers

9.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Attacker must already hold the create_users capability, so PR:L not PR:N; import is a simple network request (AC:L, UI:N); admin takeover yields C:H/I:H, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:35 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

9.1 (CRITICAL)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress Import/Export Users Plugin - CVE-2026-16534 Aug 04, 2026

AnalysisAI

Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds only the user-creation capability create a full administrator account and overwrite an existing administrator's password or email via the CSV import routine. The plugin fails to re-check WordPress role-assignment and per-user edit permissions on imported rows, so a low-tier account can seize total control of the site. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as user with create_users capability

Delivery

Open plugin CSV import screen

Exploit

Upload CSV assigning administrator role or targeting existing admin

Execution

Plugin applies role/password/email without permission check

Persist

Gain administrator account or hijacked admin

Impact

Full site takeover

Access

Authenticate as user with create_users capability

Delivery

Open plugin CSV import screen

Exploit

Upload CSV assigning administrator role or targeting existing admin

Execution

Plugin applies role/password/email without permission check

Persist

Gain administrator account or hijacked admin

Impact

Full site takeover

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress account that holds the user-creation capability (create_users) and access to the plugin's CSV import function on a site running the plugin below version 2.4.2. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed but lean toward genuine priority for sites that expose the create_users capability to non-administrators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who controls a WordPress account granted only the user-creation capability (for example a delegated shop or membership manager) crafts a CSV that assigns the 'administrator' role to a new user, or that targets an existing admin's username to reset its password/email, then submits it through the plugin's import screen. Because the plugin does not re-validate role-assignment or edit permissions, the CSV values are applied verbatim, handing the attacker administrator access. …
Remediation	Vendor-released patch: upgrade the "Import and export users and customers" plugin to version 2.4.2 or later, which restores enforcement of WordPress role-assignment and per-user edit permissions during CSV import. … Detailed patch versions, workarounds, and compensating controls in full report.