External risk intelligence

POUCO WordPress Plugin Account Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16256

This vulnerability affects a WordPress plugin that exposes AJAX actions to the public internet by design. Because it is a web-based plugin intended for external interaction and handles user registration, it is inherently reachable and exposed in any standard public-facing WordPress deployment.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the POUCO Import Users WordPress plugin allows unauthenticated attackers to create administrator accounts and potentially take over websites. The issue stems from improper checks on user-submitted data, enabling attackers to bypass security measures and gain full control. The main concern is confirming relevance and exposure of this plugin within your environment.

Unauthenticated users can gain admin access.
Critical security flaw, potential site takeover.
Confirm plugin use and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a request to the vulnerable WordPress plugin. This request targets the plugin's AJAX actions, which are accessible without any login or special permissions. By manipulating the role assigned in this request, an attacker can create a new administrator account and gain complete control of the website.

No authentication needed to access.
Triggers by sending a crafted AJAX request.
Leads to full website takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to create a new administrator account on a WordPress site. When supported by the advisory, this could lead to a complete takeover of the website.

WordPress user accounts and site administration.
Unauthenticated AJAX actions allow role manipulation.
Complete site takeover and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the POUCO Import Users WordPress plugin allows unauthenticated attackers to create administrator accounts and gain full site control. Immediate action is required, prioritizing the identification and containment of affected systems. Owners of WordPress sites and their associated infrastructure teams should lead this effort, working closely with security and vendor management to mitigate the risk.

WordPress site owners own this issue.
Verify plugin reachability and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the POUCO Import Users plugin?

POUCO Import Users is a WordPress plugin designed to streamline the bulk creation or migration of user accounts into a WordPress site. It is commonly used by site administrators to automate adding large groups of users without manual input. Because it interacts directly with the site's user database and authentication systems, it requires high-level privileges to function correctly, making any flaw in its design particularly impactful for site integrity.

What does CWE-269 mean for CVE-2026-16256?

CWE-269 refers to Improper Privilege Management. In the context of this vulnerability, it means the plugin fails to verify who is making a request or what permissions they hold before performing sensitive tasks. Specifically, the plugin neglects to check if a user is authorized to create accounts. Because it lacks these checks, it treats an unauthorized request from an outsider as if it came from a trusted administrator, allowing the system to be manipulated into granting excessive privileges.

How is this vulnerability triggered?

An attacker triggers the bug by sending a specifically crafted AJAX request to the plugin. This action does not require the attacker to have an existing account, login credentials, or any prior session on the website. Importantly, the vulnerability is not triggered by standard site navigation or routine user activity; it requires the deliberate submission of a request that includes an attacker-specified role, which the plugin then processes without verifying the sender's identity.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that because this plugin is designed to handle user registrations via public web requests, it is inherently reachable in standard WordPress deployments. If your site uses this plugin and is accessible via the internet, it is considered highly likely to be exposed. This accessibility is a core feature of the plugin's operation, meaning you should assume the risk is relevant if the plugin is active, regardless of the site's specific configuration.

What steps should I take if I use this plugin?

Your first step is to immediately verify if the POUCO Import Users plugin is installed and active on your WordPress instances. If found, assess whether its functionality is currently required for your operations. If the plugin is not essential, deactivate and remove it from your environment to eliminate the risk entirely. If the plugin is required, prioritize restricting access to its functionality or seek an alternative way to manage user imports until a secure update is available.

References

wpscan.com/vulnerability/c7442f47-7263-4cbb-8157-a4ac69953c95/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.