PT-2026-29473 · WordPress · Export All Urls

Mohammad Aghdasi · CVE-2026-2696 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Export All URLs WordPress plugin versions prior to 5.1

Description The Export All URLs WordPress plugin versions before 5.1 creates CSV filenames with predictable patterns based on post URLs, including those for private posts. These files are saved in the publicly accessible 'wp-content/uploads/' directory, allowing unauthenticated users to potentially access sensitive data by brute-forcing the filenames.

Recommendations Update the Export All URLs WordPress plugin to version 5.1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-2696

Affected Products

Export All Urls

References · 3

• 🔥 https://wpscan.com/vulnerability/55d627c1-ad05-4cd1-ae7b-932d84c19313 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2696 · Security Note
• https://twitter.com/CVEnew/status/2039279651571507295 · Twitter Post