CVE-2026-15026 carazo CVE debrief

Who should care

Authenticated attackers with subscriber-level access and above in WordPress installations using the Import and export users and customers plugin version 2.4.0 or earlier should be aware of this vulnerability. Additionally, administrators and security teams responsible for WordPress installations should review and implement necessary mitigations.

Technical summary

The Import and export users and customers plugin for WordPress exposes a Sensitive Information Exposure vulnerability in all versions up to, and including, 2.4.0 via the email_template_selected parameter. This allows authenticated attackers with subscriber-level access and above to extract post_title and raw post_content of arbitrary posts by enumerating post IDs, regardless of post status or type. The vulnerability is caused by the plugin exposing the required codection-security nonce as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL. This makes it possible for attackers to exploit the vulnerability and extract sensitive information. The vulnerability has a CVSS score of 4.3 and is considered Medium priority. To exploit this vulnerability, an attacker would need to enumerate post IDs and access the wp-admin page with the specific URL parameter. The exploitation of this vulnerability could lead to the exposure of sensitive post information.

Defensive priority

Medium priority due to the CVSS score of 4.3 and the potential for sensitive information exposure.

Recommended defensive actions

• Update the Import and export users and customers plugin to a version beyond 2.4.0.
• Restrict access to the wp-admin area to trusted users only.
• Monitor for suspicious activity related to post enumeration and sensitive information exposure.
• Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-10T09:16:53.277Z and was last modified on 2026-07-10T15:43:30.330Z. The NVD entry is currently Deferred. The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.