PT-2025-48641 · WordPress · Export All Posts

Lucky_Buddy · Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-13606

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Export All Posts, Products, Orders, Refunds & Users plugin for WordPress versions prior to 2.20

Description The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is susceptible to Cross-Site Request Forgery. This is because of inadequate or absent nonce validation within the parseData function. Successful exploitation allows unauthenticated attackers to export sensitive information, including user data, email addresses, password hashes, and WooCommerce data. The attacker can specify an attacker-controlled file path on the server for the exported data, requiring a site administrator to perform an action, such as clicking a malicious link, to complete the attack.

Recommendations Update the Export All Posts, Products, Orders, Refunds & Users plugin to version 2.20 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-13606

Affected Products

Export All Posts

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13606 · Security Note
• https://plugins.trac.wordpress.org/changeset/3405694 · Note
• https://t.me/cveNotify/144498 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3511e110-d091-447d-87c0-25d33900bc30?source=cve · Note
• https://t.me/CVEtracker/38637 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995750424062595460 · Twitter Post