CVE-2026-2696 in Export All URLs Plugin

要約 (英語)

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.

責任者

WPScan

予約する

2026年02月18日

公開

2026年04月01日

エントリ

VulDB provides additional information and datapoints for this CVE:

識別子	脆弱性	CWE	悪用可	対策	CVE
354611	Export All URLs Plugin CSV uploads 情報漏えい	200	未定義	公式な修正	CVE-2026-2696