We‑mp‑rss versions through 1.5.3 contain a missing authentication check on the /api/v1/wx/tools/export/download endpoint. The authentication dependency was commented out, allowing any requester to supply an mp_id and a predictable, timestamp‑based filename and download export archives located under data/docs. Additionally, the delete_after_download flag can trigger removal of the archive. This flaw permits unauthenticated download of potentially sensitive content and the ability to delete exported files, leading to confidentiality compromise and data loss.

The affected product is the we‑mp‑rss application maintained by rachelos, impacting all releases up to and including version 1.5.3. No specific patch version is listed, so any instance running 1.5.3 or earlier without the authentication guard is vulnerable.

The CVSS v3 score is 6.3, reflecting a medium‑severity flaw that enables remote unauthenticated access. EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the exposed endpoint via a standard network request to retrieve or delete export archives. The exploit requires minimal effort beyond discovery of the endpoint and construction of a valid filename, indicating a relatively low barrier to exploitation for threat actors with network reach to the target.