CVE-2026-2696: Export All URLs WordPress Info Disclosure

CVE-2026-2696 Overview

The Export All URLs WordPress plugin before version 5.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive data through predictable CSV filename generation. The plugin generates export files containing post URLs (including private posts) using a weak random 6-digit number pattern, storing these files in the publicly accessible wp-content/uploads/ directory. This predictable naming scheme enables attackers to brute-force filenames and gain unauthorized access to exported data.

Critical Impact

Unauthenticated attackers can enumerate and access CSV export files containing sensitive post URLs, including private content, by brute-forcing the predictable 6-digit filename pattern.

Affected Products

• Export All URLs WordPress Plugin versions prior to 5.1
• WordPress installations with vulnerable Export All URLs plugin installed
• Sites storing exported CSV files in publicly accessible directories

Discovery Timeline

• 2026-04-01 - CVE-2026-2696 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-2696

Vulnerability Analysis

This vulnerability stems from insecure randomness in the file naming mechanism combined with improper access controls on exported files. The Export All URLs plugin generates CSV files containing all URLs from a WordPress site, including URLs for private and draft posts that should not be publicly accessible.

The core issue lies in the plugin's use of a 6-digit random number for filename generation. With only 1 million possible combinations (000000-999999), an attacker can feasibly enumerate all possible filenames through automated brute-force requests. The vulnerability is classified as CWE-200 (Information Exposure), as it allows unauthorized disclosure of sensitive information to actors who should not have access.

Root Cause

The vulnerability exists due to two compounding security weaknesses:

1. Insufficient Randomness: The plugin uses a 6-digit random number for filename generation, providing inadequate entropy. Cryptographically secure random identifiers should use significantly longer strings with higher entropy to prevent enumeration attacks.

2. Improper Access Control: Export files are stored in the publicly accessible wp-content/uploads/ directory without any authentication checks or access restrictions. There is no .htaccess protection, capability checks, or token-based access validation.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker would perform the following steps:

1. Identify that a target WordPress site uses the Export All URLs plugin (through plugin enumeration or error messages)
2. Craft requests to wp-content/uploads/ targeting potential CSV filenames with the pattern using 6-digit numbers
3. Automate requests to iterate through the 1 million possible filename combinations
4. Successfully retrieved CSV files expose all exported URLs, potentially including private post URLs, draft content paths, and other sensitive site structure information

The attack is feasible because modern tools can iterate through 1 million requests relatively quickly, especially if rate limiting is not in place. Once a valid filename is discovered, the attacker gains immediate access to the exported data.

Detection Methods for CVE-2026-2696

Indicators of Compromise

• Unusual volume of HTTP requests targeting the wp-content/uploads/ directory with sequential or patterned filenames
• Multiple 404 responses followed by successful 200 responses for CSV files in upload directories
• Access logs showing requests for CSV files from external IP addresses without corresponding admin activity
• Automated scanning patterns in server logs targeting numeric filename patterns

Detection Strategies

• Monitor web server access logs for enumeration patterns against the uploads directory
• Implement web application firewall (WAF) rules to detect and block rapid sequential requests to upload paths
• Configure intrusion detection systems to alert on unusual file access patterns in WordPress directories
• Review plugin usage and identify installations of Export All URLs plugin versions prior to 5.1

Monitoring Recommendations

• Enable detailed logging for all requests to wp-content/uploads/ subdirectories
• Set up alerts for high-frequency requests from single IP addresses targeting CSV file patterns
• Monitor for successful downloads of export files that don't correlate with legitimate admin export activities
• Implement rate limiting on the uploads directory to slow potential brute-force attempts

How to Mitigate CVE-2026-2696

Immediate Actions Required

• Update the Export All URLs WordPress plugin to version 5.1 or later immediately
• Review server logs for any historical access to export CSV files from unauthorized sources
• Remove any existing export files from the wp-content/uploads/ directory
• Audit private and draft post content for potential exposure

Patch Information

The vulnerability is addressed in Export All URLs plugin version 5.1 and later. Site administrators should update through the WordPress plugin management interface or download the latest version from the WordPress plugin repository. For detailed vulnerability information, refer to the WPScan Vulnerability Report.

Workarounds

• Restrict access to the wp-content/uploads/ directory using server-level access controls
• Implement .htaccess rules to block direct access to CSV files in the uploads directory
• Use a security plugin to add authentication requirements for export file downloads
• Consider disabling the Export All URLs plugin until an update can be applied
• Move export files to a non-publicly-accessible directory outside the web root

# Apache .htaccess configuration to restrict CSV access in uploads
# Add to wp-content/uploads/.htaccess

<FilesMatch "\.csv$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Require authentication for CSV files
<FilesMatch "\.csv$">
    AuthType Basic
    AuthName "Restricted Access"
    AuthUserFile /path/to/.htpasswd
    Require valid-user
</FilesMatch>