CVE-2026-24574: Export WP Page to Static HTML CSRF Flaw

CVE-2026-24574 Overview

CVE-2026-24574 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Recorp Export WP Page to Static HTML/CSS WordPress plugin. The flaw exists in all versions up to and including 6.0.0. An attacker can trick an authenticated WordPress user into submitting a forged request that performs unauthorized actions within the plugin. Successful exploitation requires user interaction, typically clicking a malicious link or visiting an attacker-controlled page while authenticated to the target WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can perform plugin actions on behalf of authenticated administrators, leading to integrity loss within affected WordPress sites running the plugin through version 6.0.0.

Affected Products

Recorp Export WP Page to Static HTML/CSS plugin for WordPress
All versions from initial release through 6.0.0
WordPress sites with the affected plugin installed and an authenticated administrative session available to be abused

Discovery Timeline

2026-05-25 - CVE-2026-24574 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24574

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protections in privileged actions exposed by the Export WP Page to Static HTML/CSS plugin. WordPress plugins are expected to validate request authenticity using nonces created with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce(). When these checks are absent or improperly implemented, an attacker-controlled page can cause an authenticated user's browser to issue state-changing requests to the WordPress backend.

The attack requires user interaction, which is consistent with classic CSRF exploitation patterns. The scope is unchanged and confidentiality is not impacted, but integrity is rated high because the forged request executes with the victim's privileges. This means an administrator visiting a malicious page can unknowingly trigger plugin functions that modify site state.

Root Cause

The root cause is missing CSRF token validation on one or more plugin endpoints that accept state-changing requests. Without anti-CSRF nonces tied to the authenticated session, the plugin treats any request bearing a valid session cookie as legitimate. Browsers automatically attach those cookies to cross-origin requests, allowing third-party sites to invoke privileged functionality.

Attack Vector

Exploitation occurs over the network and requires the victim to be authenticated to the target WordPress site. An attacker hosts a crafted HTML page containing an auto-submitting form or image tag that targets a vulnerable plugin endpoint. When an authenticated administrator visits the page, the browser issues the forged request and the plugin executes the action. Detailed technical context is available in the Patchstack CSRF Vulnerability Report.

Detection Methods for CVE-2026-24574

Indicators of Compromise

HTTP POST or GET requests to plugin endpoints under /wp-admin/ containing a Referer header from an unrelated external domain
Plugin action requests submitted without a valid _wpnonce parameter or with a missing nonce field
Unexpected static export operations or configuration changes in plugin logs that do not correlate with administrator activity

Detection Strategies

Review WordPress access logs for state-changing requests to the plugin that originated from off-site referers
Audit the plugin's PHP source for calls to check_admin_referer(), check_ajax_referer(), or wp_verify_nonce() on privileged handlers
Correlate administrator browser activity with plugin events to identify actions performed without explicit user intent

Monitoring Recommendations

Enable WordPress audit logging for administrative actions and retain logs for forensic review
Alert on outbound navigation from administrator sessions to untrusted domains followed by inbound wp-admin requests
Monitor file system changes in the plugin's export directories for unexpected output generated outside administrator working hours

How to Mitigate CVE-2026-24574

Immediate Actions Required

Upgrade the Export WP Page to Static HTML/CSS plugin to a version released after 6.0.0 that addresses CVE-2026-24574 once available from the vendor
Restrict administrative access to trusted IP ranges and require administrators to log out of WordPress when not actively managing the site
Deploy a web application firewall rule that enforces same-origin checks on wp-admin POST requests for the affected plugin endpoints

Patch Information

A fixed version beyond 6.0.0 should be applied as soon as it is published by the vendor. Refer to the Patchstack CSRF Vulnerability Report for the latest remediation status. If no patch is available, deactivate and remove the plugin until a fixed release is published.

Workarounds

Deactivate the plugin until a patched release is available
Enforce strict SameSite=Lax or SameSite=Strict attributes on WordPress authentication cookies to reduce cross-site request risk
Require administrators to use a dedicated browser profile that is not used for general web browsing while managing the site

bash

# Configuration example: disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate export-wp-page-to-static-html
wp plugin status export-wp-page-to-static-html