CyberRota Analysis
AI-GeneratedThe POUCO Import Users plugin for WordPress versions up to 1.0.0 is vulnerable due to a lack of capability and nonce checks on AJAX actions, allowing unauthenticated users to create and update WordPress accounts. This flaw enables attackers to create a new administrator account, potentially leading to full site takeover. WordPress site administrators using this plugin should prioritize immediate updates or mitigations to prevent unauthorized access.
Original NVD Description
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.