We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-16256

CVE-2026-16256

WordPress

Severity: —
CVSS: —CVSS
Published: 2026-08-02
Last modified: 2026-08-02

Description

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.

References

https://wpscan.com/vulnerability/c7442f47-7263-4cbb-8157-a4ac69953c95/

Summary

Description

References