CVE-2026-16534

A vulnerability exists in versions of the Import and export users and customers plugin prior to 2.4.2, where CSV imports fail to adhere to WordPress's role-based access controls and edit permissions for individual users, enabling a user with limited privileges to create administrative accounts and alter existing administrators' login credentials. This oversight allows an attacker to circumvent intended security restrictions during the import process.

Based on public CVE data (MITRE/NVD).