CVE-2026-15026: WordPress Import Export Users Plugin Exposes Private Posts and WooCommerce Orders

Technical summary

The vulnerability stems from two compounding flaws in the plugin's email template functionality. First, a security nonce used to validate administrative actions is embedded as inline JavaScript on any wp-admin page when the email_template_selected parameter is accessed via ?post_type=acui_email_template. This nonce is world-readable to any authenticated user, including Subscribers. Second, the plugin's backend functions that retrieve post_title and post_content lack proper capability checks, allowing attackers to enumerate post IDs and extract content regardless of post status (draft, private, future, trash, password-protected) or custom post type. This means internal WooCommerce orders, CRM records, and other non-public post types become accessible. The attack vector is network-based, requires only low-privilege authentication, and involves no user interaction.

Business impact

For WordPress sites running this plugin, the risk profile depends on what data is stored as posts. Sites using WooCommerce, custom CRM post types, or internal documentation systems face material exposure: customer order details, contact information, pricing notes, and unpublished content become readable by any subscriber-level user or former employee with retained access. For membership or multi-author sites, this breaks content embargo strategies—draft articles, private notes, and scheduled posts leak prematurely. Reputational and compliance damage (GDPR, HIPAA, PCI-DSS) follows if personal or financial data is exposed. The low barrier to exploitation (basic login) and high data sensitivity create significant business liability.

Affected systems

The 'Import and export users and customers' plugin in all versions up to and including 2.4.0 is affected. WordPress installations with this plugin enabled, particularly those running WooCommerce or custom post type plugins, face exposure. Any site with subscriber-level users (including contractors, former employees, or compromised low-privilege accounts) can be leveraged for exploitation. The plugin is commonly used in multi-user WordPress environments, making exposure scenarios realistic in real-world deployments.

Exploitability

Exploitability is straightforward: an attacker needs only valid WordPress login credentials at subscriber level or higher (easily obtained via credential compromise, social engineering, or legitimate employment). No special tools, no public exploits, and no user interaction required. The nonce exposure requires a simple HTTP request to ?post_type=acui_email_template, and post enumeration is trivial (post IDs are often sequential or predictable). The CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for prior authentication, but this understates risk in multi-user or compromised-credential scenarios where low-privilege access is common. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog, but active exploitation is likely given the simplicity of the attack.

Remediation

Immediately upgrade the 'Import and export users and customers' plugin to a patched version beyond 2.4.0 (verify availability from the plugin vendor). Patch availability and timing should be confirmed directly with the plugin maintainer or WordPress plugin repository. Concurrently, audit and disable the plugin on production sites if not in active use. For sites dependent on the plugin, implement interim controls: restrict subscriber-level account creation, enforce strong authentication (2FA), regularly audit user roles and remove unnecessary accounts, and monitor access logs for post retrieval patterns. Database-level monitoring for direct post meta queries can detect exploitation attempts.

Patch guidance

Check the WordPress plugin repository or the vendor's security advisory for version 2.4.1 or later. Apply patches during a maintenance window after backup and staging-environment testing. The plugin may require reactivation or configuration review post-update. If the vendor has not released a patch, consider migrating to an alternative user/customer import tool or disabling the plugin until a fix is available. Document your patch timeline and testing results for compliance records.

Detection guidance

Monitor for suspicious patterns: repeated HTTP requests to wp-admin with ?post_type=acui_email_template parameters; database queries for post_title and post_content from non-standard post types originating from low-privilege user sessions; or unusual post enumeration (sequential ID requests). Web application firewalls (WAF) can rate-limit admin panel access. WordPress security plugins (e.g., Wordfence, Sucuri) can alert on anomalous post meta queries. Log subscriber and contributor account logins and flag access to email_template functionality. Intrusion detection should flag patterns consistent with post ID brute-force enumeration.

Why prioritize this

Although CVSS 3.1 rates this MEDIUM (4.3), context elevates urgency for most organizations. The vulnerability requires only subscriber-level authentication—a low bar in organizations with high user churn, contractors, or compromised credentials. Exposure is not limited to public content; private, draft, and custom post types (WooCommerce orders, CRM records) leak wholesale. Data sensitivity is typically high (customer info, financial records, internal notes). Non-inclusion in CISA KEV does not indicate low risk; rather, exploitation is likely opportunistic and not yet coordinated at scale. Organizations running this plugin alongside e-commerce or internal data systems should prioritize patching and interim controls.

Risk score, explained

CVSS 3.1 assigns 4.3 (MEDIUM) based on low attack complexity, network vector, low privileges required, and confidentiality impact only. No integrity or availability impact is noted. However, this does not capture the full risk in real-world environments. The true risk depends on: (1) whether the site hosts sensitive data in posts or custom post types; (2) subscriber-level account prevalence and credential hygiene; (3) regulatory or contractual data protection obligations. A small blog with no WooCommerce scores lower practical risk; an e-commerce site or multi-author publication platform with active collaborators scores higher. Apply CVSS as a baseline, then layer business and operational context.

Frequently asked questions