EUVD-2026-42851
GHSA-73h4-5g99-ccr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible wp-admin endpoint exploitable by any subscriber (PR:L, AV:N, AC:L); impact is read-only post content disclosure with no integrity or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
AnalysisAI
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. The exploit barrier is exceptionally low: the required security nonce is leaked as inline JavaScript on any wp-admin page reachable by subscribers. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Technical ContextAI
The flaw is rooted in CWE-862 (Missing Authorization) within the plugin's email template selection handler, specifically the email_template_selected endpoint. The codection-security nonce - visible in WordPress plugin repository source at email-templates.php#L96 and email-options.php#L357 across at least tagged versions 2.0.10 and 2.3.9 - is intended as a CSRF defense but is exposed as inline JavaScript on any wp-admin page when the query string ?post_type=acui_email_template is appended. Because WordPress grants all authenticated users including Subscribers access to wp-admin, any logged-in user can harvest this nonce. The email_template_selected handler then queries WordPress posts by supplied ID without enforcing post_status or capability checks, allowing sequential post ID enumeration to retrieve content from posts that WordPress's native access controls would otherwise protect. The affected software is identified by CPE cpe:2.3:a:carazo:import_and_export_users_and_customers:*:*:*:*:*:*:*:* and is distributed through the WordPress.org plugin repository.
RemediationAI
Update the Import and Export Users and Customers plugin to a version above 2.4.0 immediately; an upstream fix commit is referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3601455%40import-users-from-csv-with-meta&new=3601455%40import-users-from-csv-with-meta, though the exact patched release version number is not independently confirmed from available data - verify the current stable version in the WordPress.org plugin directory before deploying. As a compensating control while patching, administrators can restrict subscriber-level access to wp-admin entirely using a capability management plugin (e.g., Members or User Role Editor), which removes the nonce harvesting vector; this trade-off blocks subscribers from other admin features they may legitimately need. Alternatively, deactivating the plugin eliminates the attack surface entirely with no side effects beyond loss of import and export functionality. On sites with closed user registration (no untrusted subscriber accounts), the practical risk is significantly reduced without additional action, though patching remains the authoritative fix. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/85b61e0f-3bb2-4688-b513-14f4d2da6c30 for confirmed patch version details.
Privilege escalation in the "Import and export users and customers" WordPress plugin before 2.4.2 lets a user who holds
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Path traversal in the 'Import and export users and customers' WordPress plugin (versions before 2.4.3) enables high-priv
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
The Import and export users and customers plugin for WordPress contains a privilege escalation vulnerability that allows
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up t
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today