What is the CVSS score of EUVD-2026-51938?

EUVD-2026-51938 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of POUCO Import Users are affected by EUVD-2026-51938?

The POUCO Import Users WordPress plugin (versions 1.0.0 and earlier) contains a critical vulnerability enabling any unauthenticated attacker to create fully privileged administrator accounts and gain…

Is there a public PoC exploit available for EUVD-2026-51938?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51938. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-51938?

Within 24 hours, inventory all WordPress installations to identify active use of POUCO Import Users plugin version 1.0.0 or earlier and immediately deactivate the plugin on all affected systems. Within 7 days, completely remove the plugin, audit user accounts for unauthorized administrator additions, reset all WordPress administrative credentials, and verify deletion through file system inspection. Within 30 days, implement a Web Application Firewall (WAF) to block AJAX requests to /wp-admin/admin-ajax.php with create_user and update_user actions lacking valid nonces, deploy automated WordPress plugin vulnerability scanning, and migrate user import workflows to a hardened, actively-maintained alternative from the WordPress.org repository.

POUCO Import Users EUVD-2026-51938

| CVE-2026-16256 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-02 WPScan

GHSA-vrg4-ffx9-cfhg

WordPress Privilege Escalation Pouco Import Users Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network AJAX request (AV:N/AC:L/PR:N/UI:N) creates an administrator, yielding total confidentiality, integrity, and availability impact on the site.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:39 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.

AnalysisAI

Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:unknown:pouco_import_users) designed to bulk-import user accounts. WordPress AJAX endpoints registered via the wp_ajax_nopriv_ hook are reachable by unauthenticated visitors; secure plugins gate such handlers with current_user_can() capability checks and check_ajax_referer() nonce validation. This plugin does neither, and additionally passes an attacker-controlled 'role' parameter directly into user creation (e.g. wp_insert_user / add_role). The root cause maps to CWE-269 (Improper Privilege Management): the code fails to constrain who may invoke a privileged operation and what privilege level the created account receives.

RemediationAI

No vendor-released patch identified at time of analysis - the affected range extends through the latest known release (1.0.0) with no fixed version cited in the WPScan (https://wpscan.com/vulnerability/c7442f47-7263-4cbb-8157-a4ac69953c95/), EUVD, or VulDB records. The most reliable action is to deactivate and remove the POUCO Import Users plugin until a patched version is published, since it exposes unauthenticated account creation with no mitigating configuration; the trade-off is losing any bulk user-import functionality it provided. If the plugin cannot be removed, use a WAF or web-server rules to block unauthenticated POST requests to /wp-admin/admin-ajax.php for the plugin's specific AJAX action names, and audit the wp_users table for unexpected administrator accounts, deleting any rogue admins and rotating credentials/secret keys; note that broad admin-ajax.php filtering can break other plugins that legitimately use unauthenticated AJAX. Monitor the vendor and WPScan advisory for a released fix and upgrade to it once available.