Import Export Plugin CVE-2026-15026

Exploitation requires a valid WordPress user account with at minimum Subscriber role on the target site - the attack is not available to unauthenticated visitors because the codection-security nonce is only rendered within wp-admin pages, which require authentication. Once authenticated, any subscriber can append ?post_type=acui_email_template to any wp-admin URL to obtain the nonce without any special capability. The Import and Export Users and Customers plugin must be installed, activated, and at version 2.4.0 or below. No further non-default configuration is required. The exploit is read-only: only post_title and raw post_content are exposed - no write, delete, or privilege escalation capability exists through this flaw. Sites with closed user registration (registration disabled or restricted to known users) have a substantially reduced exposure because untrusted parties cannot obtain a Subscriber account to begin the attack.

The NVD CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a constrained confidentiality impact, and the authentication requirement (PR:L) does meaningfully reduce the attack surface relative to unauthenticated flaws. However, real-world risk is environment-dependent and can substantially exceed what the base score implies: on WooCommerce or CRM-integrated sites, exposed non-public custom post types may contain customer PII, order details, payment metadata, and internal business records, elevating the effective confidentiality impact well beyond generic post content. The nonce harvesting step requires only a URL parameter append, making the overall exploit chain trivially scriptable with basic HTTP tooling - low complexity despite the subscriber prerequisite. EPSS data was not supplied in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public exploit code has been identified, reducing urgency for sites with closed user registration. Sites that allow open user registration or have untrusted subscriber accounts should treat this as higher priority than the base score suggests.

A registered subscriber on a WooCommerce-integrated WordPress site appends ?post_type=acui_email_template to any wp-admin URL, reads the codection-security nonce from the page's inline JavaScript, and then iterates sequential integers via the email_template_selected endpoint to extract post_title and raw post_content for each ID - surfacing WooCommerce order records, draft product descriptions, private customer notes, and CRM entries that WordPress role controls would ordinarily deny. No public exploit code has been identified, but the attack requires only basic scripting skills and standard HTTP tooling given the entirely predictable nonce delivery mechanism.