CVE-2025-58980: Export WP Page Auth Bypass Vulnerability

CVE-2025-58980 Overview

CVE-2025-58980 is a missing authorization vulnerability in the recorp Export WP Page to Static HTML/CSS WordPress plugin (export-wp-page-to-static-html). The flaw affects all versions up to and including 4.1.0. Unauthenticated attackers can access plugin functionality that should be restricted by access control lists (ACLs). The issue is classified under CWE-862: Missing Authorization and receives a CVSS v3.1 score of 5.3. Exploitation requires no privileges, no user interaction, and can be conducted over the network.

Critical Impact
Remote unauthenticated attackers can invoke plugin functions not properly constrained by ACLs, resulting in limited confidentiality impact on affected WordPress sites.

Affected Products

recorp Export WP Page to Static HTML/CSS plugin for WordPress
All versions from n/a through 4.1.0
WordPress sites with the export-wp-page-to-static-html plugin installed and activated

Discovery Timeline

2025-09-09 - CVE-2025-58980 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58980

Vulnerability Analysis

The vulnerability results from missing authorization checks within the Export WP Page to Static HTML/CSS plugin. The plugin exposes functionality intended for privileged users without validating the requester's role or capabilities. As a result, requests originating from unauthenticated or low-privilege users reach handlers that should enforce administrative access. The confidentiality impact is limited to information exposed by the affected functionality, with no direct integrity or availability impact per the CVSS vector. Broken access control remains one of the most prevalent classes of WordPress plugin vulnerabilities, particularly in plugins that generate or export site content.

Root Cause

The root cause is the absence of proper capability checks such as current_user_can() on plugin endpoints. WordPress plugins commonly register AJAX actions or REST routes that must validate user permissions before execution. In export-wp-page-to-static-html version 4.1.0 and earlier, one or more handlers do not perform these validations, allowing execution paths that should be constrained by ACLs to run for any requester.

Attack Vector

An attacker sends a crafted HTTP request directly to the vulnerable plugin endpoint on a WordPress site running a vulnerable version. Because authentication is not required, the request can originate from any internet-connected host. Successful exploitation returns information exposed by the underlying function. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-58980

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to plugin AJAX endpoints such as wp-admin/admin-ajax.php with action parameters referencing the export plugin
Requests to plugin-specific REST routes under /wp-json/ originating from unfamiliar IP addresses
Unexpected static HTML/CSS export files generated outside normal administrative activity

Detection Strategies

Inventory WordPress installations and identify sites running export-wp-page-to-static-html version 4.1.0 or earlier
Review web server access logs for anonymous requests targeting plugin endpoints
Correlate plugin activity with authenticated administrator sessions to identify anomalies

Monitoring Recommendations

Enable WordPress audit logging to capture plugin action invocations and originating user context
Alert on repeated requests to admin-ajax.php with plugin-specific action values from unauthenticated sessions
Monitor for new files appearing in export directories without corresponding administrator activity

How to Mitigate CVE-2025-58980

Immediate Actions Required

Update the Export WP Page to Static HTML/CSS plugin to a version later than 4.1.0 once a patched release is available
Deactivate and remove the plugin if a patched version has not been published and the functionality is not essential
Restrict access to WordPress administrative endpoints using web application firewall (WAF) rules or IP allowlists

Patch Information

At the time of publication, the vulnerability affects versions up to and including 4.1.0. Consult the Patchstack Vulnerability Report for the current patch status and vendor guidance.

Workarounds

Block unauthenticated requests to plugin AJAX actions and REST routes at the WAF or reverse proxy layer
Enforce authentication on wp-admin/admin-ajax.php where feasible for the affected action parameters
Disable the plugin until a fixed version is confirmed and deployed

bash

# Example WAF rule concept: block unauthenticated access to plugin AJAX action
# (adapt syntax for your WAF: ModSecurity, Cloudflare, AWS WAF, etc.)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1058980,msg:'Block unauthenticated export-wp-page-to-static-html actions'"
  SecRule ARGS:action "@rx (?i)export_wp_page_to_static" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"