The Export All URLs WordPress plugin prior to version 5.1 writes exported CSV files that include URLs for all posts, even private ones. The filenames are generated with an apparently random 6‑digit number and are stored in the publicly addressable wp‑content/uploads directory. Because the file names can be guessed or brute‑forced, an unauthenticated user can download these files and read sensitive data that should not be exposed. This vulnerability is a form of sensitive data exposure, classified as CWE‑200.

WordPress sites that have installed the Export All URLs plugin and are running any version older than 5.1. Site administrators should review whether the plugin is in use, and if so, determine the current version they are running.

The CVSS score of 5.3 indicates a moderate severity impact, but the EPSS score of less than 1 % shows that the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits. Nevertheless, the attack vector is unauthenticated file download: an attacker simply needs to guess the 6‑digit filename to retrieve the exported CSV. Even with low probability, the potential exposure of private post URLs warrants proactive remediation.