Export All URLs < 4.4 - Admin+ Arbitrary System File Removal
Priority LOW 31CWE-73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server
Why it matters now
EPSS 0.0119 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Export All URLs (Unknown): 4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Export All URLs | 4.4 to before 4.4 | 4.4 | Patch available | CNA |
- Export All URLs VendorUnknown Affected 4.4 to before 4.4 Fixed in 4.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:* | before 4.4 | Vulnerable | Atlas Gondal |
- cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:* Versions before 4.4 Vulnerable ·Atlas Gondal
Remediation
- Fix · CNA Export All URLs (Unknown) Fixed in 4.4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2638
- 2026-10-03 Alias added: GHSA-448f-ww7h-5m58
References
More Atlas Gondal Export All Urls vulnerabilities
- TI-2023-02922 Export All URLs < 4.6 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2023-28162 WordPress Export Media URLs plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
- TI-2022-00818 Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF CVSS 3.1MEDIUM 6.5
- TI-2022-00796 Export All URLs < 4.2 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2022-10739 WordPress Export All URLs Plugin <= 4.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.4
- TI-2022-11922 WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 4.8
Sources
- CVE-2022-2638 · CVE Program
- CVE-2022-2638 · NVD
- FIRST EPSS
- GHSA-448f-ww7h-5m58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences