A missing authorization check in the Import and export users and customers WordPress plugin enables an authenticated user with subscriber-level access or higher to retrieve the post_title and raw post_content of any post, regardless of its status or post type, by enumerating post IDs. The vulnerability permits exposure of potentially confidential content such as private posts, drafts, future posts, or WooCommerce orders, which may contain personal or business sensitive data.

The vulnerability affects all versions of the Import and export users and customers plugin by carazo, up to and including version 2.4.0, which is installed on WordPress sites. Users should verify the installed plugin version and take corrective action if they are running a vulnerable release.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack path requires only authentication within the WordPress admin area; any authenticated user can append ?post_type=acui_email_template to a wp-admin URL to expose a nonce in inline JavaScript, and then make an AJAX request to the vulnerable email_template_selected action to enumerate post IDs. Because the flaw does not require higher privileges and the nonce is widely exposed, it is reasonably easy to exploit for users with access to the WordPress admin interface.