CVE-2026-15026 Details
Description
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
A vulnerability allowing sensitive information exposure has been identified in the WordPress Import and Export Users and Customers plugin, affecting all versions through 2.4.0. The issue arises from the email_template_selected AJAX action, which lacks proper authorization. This vulnerability enables authenticated attackers with subscriber-level access or higher to extract the post_title and raw post_content from arbitrary posts, regardless of their status or post type. The vulnerability can be exploited by enumerating post IDs. Additionally, the required codection-security nonce is exposed as inline JavaScript on any wp-admin page when the post_type is set to acui_email_template, a condition accessible to all authenticated users, including subscribers.
Users are advised to update the Import and Export Users and Customers plugin to version 2.4.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Codection Import and export users and customers | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |