CVE-2026-15026 is a CWE-862 Missing Authorization vulnerability in the carazo Import and export users and customers WordPress plugin. Authenticated users with subscriber-level privileges can exploit the exposure of a security nonce in inline JavaScript on wp-admin pages when the URL includes ?post_type=acui_email_template. This allows them to enumerate post IDs and retrieve the post_title and raw post_content of arbitrary posts, including drafts, private, future, trash, password-protected posts, and non-public custom post types such as WooCommerce orders and internal CRM records. The vulnerability affects all versions up to and including 2.4.0, though no explicit affected versions are provided in the data. The CVSS 3.1 base score is 4.3, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.

Authenticated users with subscriber-level access or higher can access sensitive information from arbitrary posts regardless of their visibility or type. This includes private and protected content as well as non-public custom post types, potentially exposing confidential business or customer data. The vulnerability does not impact data integrity or availability but results in a confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for suspicious activity. Avoid appending ?post_type=acui_email_template to URLs in wp-admin or restrict access to such URLs if possible.