THREAT OPS › Threat News › [NVD] CVE-2026-16256 — The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to
[NVD] CVE-2026-16256 — The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to
CVE-2026-16256 CVSS: None Published: 2026-08-02T06:16:39.163
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the sit
Indicators of compromise
- CVE-2026-16256cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16256