CVE-2022-0914CWE-352

Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF

published April 11, 2022

CVSS
—
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00645 · 50.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-04-11T14:40Z
EPSS history
Timeline
  • 11 APR 14:40Z
    Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF
    cvelistv5