Pouco Import Users
Monthly
Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.
Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.