The POUCO Import Users plugin for WordPress fails to verify capabilities or nonce tokens for AJAX calls that create or update user accounts. An attacker can send unauthenticated requests to these endpoints with an attacker‑supplied role value, causing a new administrator account to be created. This results in remote privileged escalation, giving full control over the site. The vulnerability maps to improper authorization weaknesses (CWE‑269).

Any WordPress installation that has the POUCO Import Users plugin installed and is running version 1.0.0 or earlier is vulnerable. The plugin is identified by the vendor string Unknown:POUCO Import Users; no further version constraints exist beyond the ≤1.0.0 release.

The CVSS score is 9.8, reflecting critical severity. The EPSS score is reported as less than 1%, indicating that the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Despite the mitigated attack probability, the potential impact is severe: an unauthenticated attacker can achieve administrator‑level access. The most plausible attack vector involves sending crafted AJAX requests to the plugin’s endpoints without any authentication or nonce tokens; this inference is based on the description that the plugin does not perform capability or nonce checks.