CVE-2026-15026mediumCWE-862

CVE-2026-15026: medium-severity vulnerability in carazo Import and export users and customers

Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action

Published

Follow this CVE+ Monitor Import and export users and customers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
carazo · Import and export users and customers
Related CVEs — carazo Import and export users and customers

In the same product, most dangerous first.

CVE-2023-6583MEDIUMImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import FunctionalityEPSS 0.8%CVE-2026-7641HIGHImport and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta FieldsEPSS 0.7%CVE-2026-120554HIGHImport and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings SaveEPSS 0.6%CVE-2026-86583HIGHImport and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile FieldsEPSS 0.5%CVE-2026-3629HIGHImport and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.4%CVE-2024-1050MEDIUMImport and export users and customers <= 1.26.5 - Missing AuthorizationEPSS 0.4%