Vulnerability in Export All Urls

CVE-2026-2696

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/up…

EPSS: 0.000 (12.7th percentile) — read the EPSS interpretation.

Affected products

  • Unknown Export All Urls — versions 0

References