Vulnerability · Published Apr 1, 2026 · Assigned by WPScan

CVE-2026-2696Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure

Medium 5.3

In plain English

A medium-severity information exposure in Export All URLs from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Export All URLs	0 – before 5.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/55d627c1-ad05-4cd1-ae7b-932d84c19313/ exploit, vdb-entry, technical-description