Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
Why it matters now
EPSS 0.00645 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Export All URLs (Unknown): 4.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Export All URLs | 4.3 to before 4.3 | 4.3 | Patch available | CNA |
- Export All URLs VendorUnknown Affected 4.3 to before 4.3 Fixed in 4.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:* | before 4.3 | Vulnerable | Atlas Gondal |
- cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:* Versions before 4.3 Vulnerable ·Atlas Gondal
Remediation
- Fix · CNA Export All URLs (Unknown) Fixed in 4.3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0914
- 2026-10-03 Alias added: GHSA-22p9-v5cc-5f4w
- 2026-10-20 EPSS moved to the 50th–90th percentile
References
More Atlas Gondal Export All Urls vulnerabilities
- TI-2023-02922 Export All URLs < 4.6 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2023-28162 WordPress Export Media URLs plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
- TI-2022-02439 Export All URLs < 4.4 - Admin+ Arbitrary System File Removal CVSS 3.1MEDIUM 6.5
- TI-2022-00796 Export All URLs < 4.2 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2022-10739 WordPress Export All URLs Plugin <= 4.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.4
- TI-2022-11922 WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 4.8
Sources
- CVE-2022-0914 · CVE Program
- CVE-2022-0914 · NVD
- FIRST EPSS
- GHSA-22p9-v5cc-5f4w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences