CVE-2026-2696 in Export All URLs Plugin
Summary
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Responsible
WPScan
Reservation
02/18/2026
Disclosure
04/01/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354611 | Export All URLs Plugin CSV File uploads information disclosure | 200 | Not defined | Official fix | CVE-2026-2696 |