The hiWeb Export Posts plugin for WordPress suffers from a CSRF flaw in its tool-dashboard-history.php file caused by missing or incorrect nonce validation. An attacker can forge a request that causes the site administrator to delete any file on the server, including critical files such as wp-config.php, which can then allow remote code execution. This flaw gives unauthenticated attackers the ability to alter filesystem contents without needing to authenticate themselves.

WordPress sites that have installed the den‑media hiWeb Export Posts plugin in version 0.9.0.0 or earlier are affected. Any publisher using these plugin versions is at risk.

The CVSS score of 8.1 indicates a high severity vulnerability with a high impact and a need for rapid mitigation. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation in the wild and the vulnerability is not currently listed in the CISA KEV catalog. Exploitability requires only a forged HTTP request and may be delivered via social engineering; no user authentication is required, making the attack surface broad for any site with an administrator who could be tricked into clicking a malicious link.