CVE-2026-16534 is a privilege management vulnerability (CWE-269) in the Import and export users and customers WordPress plugin prior to version 2.4.2. The plugin fails to enforce WordPress's role-assignment and per-user edit permissions during CSV import operations. This allows a user who has the capability to create users, but not necessarily administrative privileges, to escalate their privileges by creating administrator accounts or modifying existing administrator credentials.

An attacker with limited user-creation capabilities can escalate privileges to administrator level by creating new admin accounts or overwriting existing administrator passwords or emails. This can lead to full site compromise, unauthorized access, and control over the WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the user-creation capability to trusted users only and monitor for unauthorized account changes. Avoid importing CSV files from untrusted sources.