EUVD-2026-42851
GHSA-73h4-5g99-ccr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible wp-admin endpoint exploitable by any subscriber (PR:L, AV:N, AC:L); impact is read-only post content disclosure with no integrity or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
AnalysisAI
Sensitive information exposure in the Import and Export Users and Customers WordPress plugin (all versions ≤ 2.4.0) allows any authenticated subscriber-level user to enumerate and extract the post_title and raw post_content of arbitrary posts regardless of visibility status or post type. Affected content includes drafts, private posts, password-protected entries, future-scheduled posts, trashed items, and non-public custom post types such as WooCommerce orders and internal CRM records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account with at minimum Subscriber role on the target site - the attack is not available to unauthenticated visitors because the codection-security nonce is only rendered within wp-admin pages, which require authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a constrained confidentiality impact, and the authentication requirement (PR:L) does meaningfully reduce the attack surface relative to unauthenticated flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A registered subscriber on a WooCommerce-integrated WordPress site appends ?post_type=acui_email_template to any wp-admin URL, reads the codection-security nonce from the page's inline JavaScript, and then iterates sequential integers via the email_template_selected endpoint to extract post_title and raw post_content for each ID - surfacing WooCommerce order records, draft product descriptions, private customer notes, and CRM entries that WordPress role controls would ordinarily deny. No public exploit code has been identified, but the attack requires only basic scripting skills and standard HTTP tooling given the entirely predictable nonce delivery mechanism. |
| Remediation | Update the Import and Export Users and Customers plugin to a version above 2.4.0 immediately; an upstream fix commit is referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3601455%40import-users-from-csv-with-meta&new=3601455%40import-users-from-csv-with-meta, though the exact patched release version number is not independently confirmed from available data - verify the current stable version in the WordPress.org plugin directory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da
Missing Authorization vulnerability in Codection Import and export users and customers.24.6. Rated medium severity (CVSS
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today