medium5.3
CVE-2026-2696
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random…
Impact
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.
Affected products
| Product | Affected versions |
|---|---|
| Export All URLs WordPress Plugin | before 5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.