CVE-2026-15026 - Import And Export Users And Customers Plugin
CVE-2026-15026
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
CVE-2026-15026
MEDIUM
CVSS 4.3
Published 2026-07-10
Updated 2026-07-10
AI Risk Moderate (46/100)
Active Exploit: No strong signal
Published Exploit: No public exploit references
Priority: P4 Planned
Severity Band
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Components
2
Reference Links
8
AI Risk Engine
Moderate (46/100)
Exploitability
High
Active Exploitation
No strong signal
Published Exploit Status
No public exploit references
AI Context
Machine-generated threat intelligence
AI
Updated 10 days ago
AI enriched 10 days ago (2026-07-11 17:04 UTC)
Technical Summary
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is…
Potential Impact
Severity is MEDIUM (CVSS 4.3). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability Assessment
Exploitability is assessed as High based on remote code execution potential.
Primary risk drivers: remote code execution potential
Mitigation Recommendations
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Detection & Monitoring
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
Business Impact Lens
AI risk score 46/100 (Moderate, High) with priority P4 Planned. Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
