CVE-2025-13606: WordPress Export Plugin CSRF Vulnerability

CVE-2025-13606 Overview

CVE-2025-13606 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Export All Posts, Products, Orders, Refunds & Users plugin for WordPress in all versions up to and including 2.19. The vulnerability exists due to missing or incorrect nonce validation on the parseData function, which allows unauthenticated attackers to export sensitive information including user data, email addresses, password hashes, and WooCommerce data to an attacker-controlled file path on the server.

This attack requires social engineering—the attacker must trick a site administrator into performing an action such as clicking on a malicious link. Once the forged request is executed, the exported data is written to a server location controlled by the attacker.

Critical Impact

Successful exploitation allows unauthenticated attackers to exfiltrate sensitive user data, email addresses, password hashes, and WooCommerce data through a forged request, potentially leading to account compromise and data breach.

Affected Products

• Export All Posts, Products, Orders, Refunds & Users plugin for WordPress versions up to and including 2.19

Discovery Timeline

• 2025-12-02 - CVE-2025-13606 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-13606

Vulnerability Analysis

This CSRF vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability classification indicates:

• Attack Vector (AV:N): Network-based attack requiring no local access
• Attack Complexity (AC:L): Low complexity, no specialized conditions required
• Privileges Required (PR:N): No authentication needed for the attacker
• User Interaction (UI:R): Requires a victim administrator to click a malicious link
• Confidentiality Impact (C:H): High impact on data confidentiality

The EPSS (Exploit Prediction Scoring System) data indicates a probability score of 0.015% with a percentile of 2.284 as of 2025-12-16, suggesting relatively low predicted exploitation activity in the wild.

Root Cause

The root cause of CVE-2025-13606 is the missing or incorrect nonce validation on the parseData function within the WordPress plugin. WordPress nonces are security tokens used to verify that requests originate from a legitimate source within the WordPress admin interface. When nonce validation is absent or improperly implemented, the application cannot distinguish between legitimate admin actions and forged requests crafted by attackers.

The parseData function handles the export functionality for posts, products, orders, refunds, and user data—all sensitive information that should be protected by proper CSRF tokens.

Attack Vector

The attack is executed through a network-based vector requiring user interaction. An attacker would craft a malicious web page or link containing a forged HTTP request that targets the vulnerable parseData function. When an authenticated WordPress administrator visits the malicious page or clicks the link while logged into their WordPress site, the browser automatically sends the forged request along with the administrator's valid session cookies.

The forged request can specify an attacker-controlled file path on the server where the exported data will be written. This exported data may include:

• WordPress user account information
• Email addresses
• Password hashes (which could be cracked offline)
• WooCommerce order data, products, and refund information

The attacker could then retrieve this exported file through direct access or other means if the file path is accessible via the web.

Detection Methods for CVE-2025-13606

Indicators of Compromise

• Unexpected export files appearing in non-standard directories on the WordPress server
• Web server logs showing POST requests to the plugin's export functionality from unusual referrers
• Unexplained data export activity without corresponding administrator actions in WordPress audit logs
• Access to export-related endpoints from external sources or suspicious IP addresses

Detection Strategies

Organizations should implement monitoring for unusual file creation activities on their WordPress servers, particularly in directories that shouldn't contain export files. Review web server access logs for patterns indicating CSRF attacks, such as requests to plugin endpoints originating from external domains.

WordPress security plugins can help detect and log export activities. Additionally, monitoring for outbound connections from the web server to unusual destinations may help identify data exfiltration attempts.

Monitoring Recommendations

Enable comprehensive logging for WordPress admin activities and plugin operations. Implement file integrity monitoring (FIM) to detect unauthorized file creation in web-accessible directories. Consider deploying a Web Application Firewall (WAF) with CSRF protection rules enabled to help block forged cross-site requests.

SentinelOne Singularity platform can provide real-time monitoring and behavioral analysis to detect anomalous file system activities and potential data exfiltration patterns associated with exploitation of this vulnerability.

How to Mitigate CVE-2025-13606

Immediate Actions Required

• Update the Export All Posts, Products, Orders, Refunds & Users plugin to the latest patched version immediately
• Review server file system for any unauthorized export files that may have been created
• Audit WordPress user accounts and consider forcing password resets if compromise is suspected
• Check web server logs for any indication of exploitation attempts

Patch Information

The vulnerability has been addressed in the plugin update. The patch details can be found in the WordPress Plugin Trac changeset at https://plugins.trac.wordpress.org/changeset/3405694/. Site administrators should update to a version newer than 2.19 that includes proper nonce validation on the parseData function.

Additional vulnerability intelligence is available from Wordfence.

Workarounds

If immediate patching is not possible, consider the following temporary mitigations:

Temporarily disable the Export All Posts, Products, Orders, Refunds & Users plugin until a patch can be applied. This eliminates the attack surface but removes export functionality.

Implement additional CSRF protection at the web server or WAF level by validating referrer headers and implementing custom security headers.

Educate administrators about the risks of clicking unknown links while logged into the WordPress admin interface. CSRF attacks rely on social engineering, so awareness is a critical defense layer.

Restrict access to the WordPress admin interface by IP address if possible, limiting the potential attack surface to known administrative networks.