CVE-2025-11693: WordPress Export Plugin Info Disclosure

CVE-2025-11693 Overview

The Export WP Page to Static HTML & PDF plugin for WordPress contains a critical Sensitive Information Exposure vulnerability affecting all versions up to and including 4.3.4. The vulnerability exists due to publicly exposed cookies.txt files containing authentication cookies. This security flaw allows unauthenticated attackers to access authentication cookies that may have been logged when a site administrator triggers a backup using specific privileged user roles such as 'administrator.'

Critical Impact

Unauthenticated attackers can access exposed authentication cookies, potentially leading to complete site compromise through session hijacking or credential theft.

Affected Products

• Export WP Page to Static HTML & PDF plugin for WordPress versions ≤ 4.3.4

Discovery Timeline

• 2025-12-13 - CVE-2025-11693 published to NVD
• 2025-12-15 - Last updated in NVD database

Technical Details for CVE-2025-11693

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in how the plugin handles backup operations and cookie storage. When administrators perform backup exports using privileged roles, the plugin inadvertently stores authentication cookies in publicly accessible cookies.txt files. These files are not properly protected from unauthorized access, allowing any unauthenticated user to retrieve sensitive session data.

The vulnerability is particularly dangerous because it requires no authentication or user interaction to exploit. An attacker simply needs to locate and access the exposed cookie files on the target WordPress installation.

Root Cause

The root cause stems from improper file permission handling and insecure storage practices within the plugin. The cookies.txt files containing sensitive authentication data are stored in web-accessible directories without adequate access controls. Additionally, the plugin fails to sanitize or exclude authentication cookies from the backup process, leading to their unintended exposure.

Attack Vector

The attack vector is network-based and can be exploited remotely without requiring authentication. An attacker can enumerate or directly access the cookies.txt files stored in predictable locations within the WordPress installation. Once retrieved, these authentication cookies can be used to:

1. Hijack administrator sessions
2. Gain unauthorized access to the WordPress admin panel
3. Perform privilege escalation attacks
4. Execute further malicious actions on the compromised site

The vulnerability mechanism involves the plugin writing authentication cookies to a text file during the export/backup process. Since this file resides in a publicly accessible location without proper access restrictions, attackers can retrieve the file via direct HTTP requests. For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11693

Indicators of Compromise

• Unexpected access requests to cookies.txt files in WordPress plugin directories
• Unusual login activity from unfamiliar IP addresses using valid administrator sessions
• HTTP access logs showing requests for files within the export-wp-page-to-static-html plugin directory
• Unauthorized administrative actions without corresponding legitimate login events

Detection Strategies

• Monitor web server access logs for requests targeting cookies.txt or similar sensitive files within the plugin directory
• Implement file integrity monitoring on the WordPress installation to detect unauthorized file access
• Configure Web Application Firewalls (WAF) to alert on suspicious requests to plugin directories
• Review WordPress admin activity logs for session usage from multiple geographic locations

Monitoring Recommendations

• Enable detailed access logging for the wp-content/plugins/export-wp-page-to-static-html/ directory
• Set up alerts for any external access attempts to text files containing sensitive keywords like "cookie" or authentication data
• Regularly audit active WordPress sessions for anomalies
• Deploy endpoint detection solutions to monitor for credential theft indicators

How to Mitigate CVE-2025-11693

Immediate Actions Required

• Update the Export WP Page to Static HTML & PDF plugin to the latest patched version immediately
• Remove any existing cookies.txt files from the plugin directory and verify no sensitive data remains exposed
• Invalidate all active WordPress sessions and force password resets for administrator accounts
• Review WordPress access logs for signs of compromise or unauthorized cookie file access
• Temporarily disable the plugin if an update is not immediately available

Patch Information

A security patch has been released to address this vulnerability. The fix can be reviewed in the WordPress Plugin Changeset. WordPress site administrators should update to the latest version available in the WordPress plugin repository. For additional vulnerability intelligence, consult the Wordfence Vulnerability Report.

Workarounds

• Restrict access to the plugin directory using .htaccess rules or web server configuration to block direct file access
• Remove the vulnerable plugin entirely until a patched version can be deployed
• Implement network-level access controls to limit who can access WordPress plugin directories
• Configure the web server to deny access to .txt files within the WordPress plugins folder

# Apache .htaccess configuration to restrict access to plugin directory
<Directory "/var/www/html/wp-content/plugins/export-wp-page-to-static-html">
    <FilesMatch "\.(txt|log)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx configuration to block access to sensitive files
location ~* /wp-content/plugins/export-wp-page-to-static-html/.*\.(txt|log)$ {
    deny all;
    return 403;
}