CVE-2026-2696
Medium
Description
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.
SeverityMedium
CVSS5.3
Exploit probability—
ProductExport All URLs
PublishedApr 1, 2026
First seenApr 1, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- Export All URLs5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Export All URLs | v < 5.1 | 5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.