CVE-2026-15026: WordPress Plugin Information Disclosure

CVE-2026-15026 Overview

CVE-2026-15026 affects the Import and export users and customers plugin for WordPress in all versions up to and including 2.4.0. The vulnerability is a Missing Authorization flaw [CWE-862] in the email_template_selected functionality that exposes arbitrary post content to low-privileged users. Authenticated attackers with subscriber-level access can extract post_title and raw post_content from any post by enumerating post IDs. The exposed data includes drafts, private posts, scheduled posts, trashed items, password-protected content, and non-public custom post types such as WooCommerce orders and internal CRM records. The required codection-security nonce is leaked as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL.

Critical Impact
Any authenticated WordPress user, including Subscribers, can read the title and body of any post or private custom post type on the site, exposing WooCommerce order details, CRM records, and unpublished content.

Affected Products

Import and export users and customers plugin for WordPress
All versions up to and including 2.4.0
Sites using non-public custom post types such as WooCommerce orders or CRM records with this plugin installed

Discovery Timeline

2026-07-10 - CVE-2026-15026 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15026

Vulnerability Analysis

The vulnerability resides in the plugin's email template preview functionality. When a user selects an email template, the email_template_selected handler retrieves post data based on a supplied post ID. The handler validates the codection-security nonce but performs no capability check to confirm the requesting user has permission to read the target post. As a result, any authenticated user can request post content that WordPress would normally restrict based on read_private_posts, read_post, or custom post type capability maps.

The issue is compounded by nonce exposure. The codection-security nonce is printed as inline JavaScript on any wp-admin page loaded with the query string ?post_type=acui_email_template. Because Subscribers can access the WordPress admin area, they can retrieve this nonce and then invoke the vulnerable AJAX endpoint. Iterating post IDs from 1 upward yields the title and body of every post regardless of status or type.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin conflates CSRF protection (the nonce) with authorization. A valid nonce confirms the request originated from the authenticated user, but it does not confirm that user has the right to read the requested post. The handler returns post_title and post_content directly from get_post() without invoking current_user_can( 'read_post', $post_id ) or checking post status.

Attack Vector

An attacker registers a Subscriber account on a site that permits open registration, or uses any existing low-privileged account. The attacker loads a wp-admin page with the query string ?post_type=acui_email_template and extracts the exposed codection-security nonce from the inline JavaScript. The attacker then submits authenticated AJAX requests to the email_template_selected endpoint, iterating post IDs to enumerate content. Sensitive data returned includes unpublished drafts, private posts, password-protected posts, and WooCommerce order records containing customer names, addresses, and order line items.

No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Insight and the plugin source in email-templates.php.

Detection Methods for CVE-2026-15026

Indicators of Compromise

Web server access logs showing requests to admin-ajax.php with the email_template_selected action originating from Subscriber-level accounts.
Repeated sequential requests referencing incrementing post_id values from a single authenticated session, indicating post ID enumeration.
Requests to wp-admin pages with the query string ?post_type=acui_email_template from users who do not manage email templates.

Detection Strategies

Monitor admin-ajax.php traffic and correlate the action parameter with the requesting user's role, flagging low-privilege users invoking template-related actions.
Alert on any authenticated session that issues more than a small threshold of email_template_selected requests within a short window.
Review WordPress user registration logs for newly created Subscriber accounts followed by activity against acui_email_template endpoints.

Monitoring Recommendations

Enable WordPress audit logging to capture AJAX action invocations tied to user IDs and roles.
Forward web server and WordPress audit logs to a centralized log platform for retention and correlation across sessions.
Track WooCommerce and CRM plugin object access patterns to identify unusual read activity from non-administrative accounts.

How to Mitigate CVE-2026-15026

Immediate Actions Required

Update the Import and export users and customers plugin to a version later than 2.4.0 that includes the fix committed in the plugin changeset 3601455.
Audit existing Subscriber and low-privileged accounts and remove any that are not required.
Disable open user registration on sites where it is not operationally required.

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by WordPress.org changeset 3601455. The fix adds an authorization check to the email_template_selected handler so that only users with the capability to manage email templates can retrieve post content. Administrators should upgrade to the fixed release via the WordPress plugin updater and verify the installed version is above 2.4.0.

Workarounds

If the plugin cannot be updated immediately, deactivate it until a patched version can be installed.
Restrict wp-admin access to trusted IP ranges via web server rules to reduce exposure of the nonce leak.
Remove Subscriber-level accounts and disable users_can_register in WordPress general settings until patching is complete.

bash

# Disable open registration and force plugin update via WP-CLI
wp option update users_can_register 0
wp plugin update import-users-from-csv-with-meta
wp plugin get import-users-from-csv-with-meta --field=version