CVE-2026-16534 is a critical vulnerability in the Import and export users and customers WordPress plugin prior to version 2.4.2. The flaw involves improper privilege management (CWE-269) where the plugin does not enforce WordPress's role-assignment and per-user edit permissions during CSV import operations. This allows an attacker with user-creation privileges but without administrative rights to escalate privileges by creating new administrator accounts or modifying existing administrator passwords or emails, potentially leading to full site compromise.

An attacker with limited privileges (user-creation capability) can escalate to administrator level by creating or modifying administrator accounts. This compromises the confidentiality and integrity of the WordPress site, allowing unauthorized administrative access without requiring user interaction or elevated privileges initially.

No official fix or patch is currently confirmed. Users should upgrade to version 2.4.2 or later once available, as this version is indicated as the fixed version. Until then, restrict user-creation capabilities to trusted users only and monitor for suspicious account creation activities. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.