CVE-2026-15026 is a CWE-862 Missing Authorization vulnerability in the carazo Import and export users and customers WordPress plugin. It affects all versions up to and including 2.4.0. Authenticated users with subscriber-level privileges can exploit the exposure of a security nonce in inline JavaScript on wp-admin pages with ?post_type=acui_email_template to enumerate post IDs and retrieve the post_title and raw post_content of arbitrary posts. This includes posts of any status (draft, private, future, trash, password-protected) and any post type, including non-public custom post types such as WooCommerce orders and internal CRM records. The vulnerability leads to sensitive information exposure without requiring higher privileges or user interaction.

The vulnerability allows unauthorized disclosure of sensitive information from arbitrary posts within the WordPress environment, including private and protected content and non-public custom post types. This exposure can lead to information leakage that may aid further attacks or compromise privacy. The impact is limited to confidentiality; integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user roles to trusted users only and monitor for suspicious activity. Avoid appending ?post_type=acui_email_template to URLs in wp-admin unless necessary. Follow updates from the plugin vendor for official patches or mitigations.