CVE-2022-0914 json
Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF
published 2022-04-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15941
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
Patch / fix
- atlasgondal export_all_urls 4.3
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Unknown Export All URLs
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
- Technology feeds
References
-
wpscan.com
/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930
exploit, third-party-advisory
Sources
- CVE List CVE-2022-0914
- NVD CVE-2022-0914
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.