The vulnerability is a missing authorization check in the Export WP Page to Static HTML/CSS plugin that permits accessing functions not properly protected by access controls. Because the export feature can generate static copies of WordPress pages, an attacker who can trigger the export could potentially extract content, media, or configuration data that should otherwise be restricted. This weakness is typified by the CWE-862 "Missing Authorization" flaw.

The flaw affects the recorp Export WP Page to Static HTML/CSS WordPress plugin versions up to and including 4.1.0. The plugin is used within WordPress sites to convert pages to static HTML and CSS and is installed on any site that has opted for that functionality.

With a CVSS score of 5.3 the vulnerability represents a medium severity risk. The EPSS score is below 1%, indicating a very low exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is via the exported page functionality, and it may be exploitable by users who can access the plugin interface; however, the description does not specify whether authentication is required, so we infer that the vulnerability may be usable by unauthenticated users with plugin access or by authenticated users lacking proper role permissions.