What the vulnerability does
01Description
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
Explanation of Vulnerability in Simple Terms
02Summary
The Import and Export Users and Customers plugin for an unspecified CMS contains a missing authorization check that allows authenticated users with low privileges to read sensitive data they should not access. An attacker with a basic user account can view confidential information without additional interaction. This affects versions up to 2.4.0.
What an attacker can do
03Attacker Capabilities
Read sensitive user or customer data that should be restricted to administrators.
Potential impact on your site
04Site Impact
User and customer data may be exposed to unauthorized account holders; data breach risk depends on what information the plugin stores.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no special interaction required.
Key dates
06Disclosure timeline
July 10, 2026
CVE published
