CVE-2026-16534

The Import and Export Users and Customers plugin for WordPress versions prior to 2.4.2 is vulnerable due to inadequate enforcement of role-assignment and per-user edit permissions during CSV imports. This flaw allows users with only user-creation capabilities to escalate their privileges by creating an administrator account or overwriting an existing administrator's credentials. WordPress site administrators and security teams should prioritize updating this plugin to mitigate the risk of unauthorized access and potential compromise.