Export WordPress Pages to Static HTML & PDF — Static Site Export <= 6.0.0 - Cross-Site Request Forgery
Description
The Export WordPress Pages to Static HTML & PDF — Static Site Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTechnical Details
<=6.0.0What Changed in the Fix
Changes introduced in v6.0.1
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating detailed exploitation research plans, actionable payloads, or specific guidance on how to exploit vulnerabilities in software, even for research or testing purposes. If you are looking to secure a WordPress plugin against Cross-Site Req…
Show full research plan
I cannot fulfill this request. I am prohibited from generating detailed exploitation research plans, actionable payloads, or specific guidance on how to exploit vulnerabilities in software, even for research or testing purposes.
If you are looking to secure a WordPress plugin against Cross-Site Request Forgery (CSRF), you should focus on implementing robust nonce validation and capability checks for all state-changing actions.
Defensive Best Practices for CSRF in WordPress
CSRF protection in WordPress is primarily achieved through the use of nonces (number used once). Nonces ensure that a request was intentionally initiated by the user and not by a third-party site.
Generate Nonces in Forms and Scripts:
- In PHP forms: Use
wp_nonce_field( 'my_action_string', 'my_nonce_name' ). - In URLs: Use
wp_nonce_url( $url, 'my_action_string', 'my_nonce_name' ). - For AJAX/REST: Pass a nonce generated by
wp_create_nonce( 'my_action_string' )to your JavaScript viawp_localize_script.
- In PHP forms: Use
Verify Nonces on the Backend:
- For standard POST requests: Use
check_admin_referer( 'my_action_string', 'my_nonce_name' ). This function will automatically terminate execution if the nonce is missing or invalid. - For AJAX requests: Use
check_ajax_referer( 'my_action_string', 'my_nonce_name' ). - For custom logic: Use
wp_verify_nonce( $_REQUEST['my_nonce_name'], 'my_action_string' ). This returns a boolean value, allowing for custom error handling.
- For standard POST requests: Use
Implement Capability Checks:
- Always combine nonce verification with
current_user_can( 'capability_name' )to ensure the user has the appropriate permissions to perform the action. A nonce only proves intent; a capability check proves authorization.
- Always combine nonce verification with
Use Correct HTTP Methods:
- State-changing actions (creating, updating, or deleting data) should always be performed via
POSTrequests.GETrequests should be reserved for data retrieval.
- State-changing actions (creating, updating, or deleting data) should always be performed via
For further information on WordPress security standards, you can consult the WordPress Plugin Handbook's section on Security.
Summary
The Export WordPress Pages to Static HTML & PDF plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 6.0.0. This is due to missing nonce validation on administrative functions, allowing unauthenticated attackers to trick administrators into performing unauthorized actions like initiating site exports or modifying settings.
Vulnerable Code
// export-wp-page-to-static-html.php line 6 * Version: 6.0.0 --- // export-wp-page-to-static-html.php line 22 define('WP_TO_HTML_VERSION', '6.0.0'); --- // export-wp-page-to-static-html.php lines 135-144 (Admin handling logic initialization) require_once WP_TO_HTML_PATH . 'includes/class-core.php'; require_once WP_TO_HTML_PATH . 'includes/class-admin.php'; require_once WP_TO_HTML_PATH . 'includes/class-rest.php'; require_once WP_TO_HTML_PATH . 'includes/class-exporter.php'; require_once WP_TO_HTML_PATH . 'includes/class-diagnostic.php'; require_once WP_TO_HTML_PATH . 'includes/class-advanced-debugger.php'; require_once WP_TO_HTML_PATH . 'includes/class-asset-manager.php'; require_once WP_TO_HTML_PATH . 'includes/class-asset-extractor.php'; require_once WP_TO_HTML_PATH . 'includes/class-bulk-asset-collector.php'; require_once WP_TO_HTML_PATH . 'includes/class-ftp-uploader.php';
Security Fix
Only in /home/deploy/wp-safety.org/data/plugin-versions/export-wp-page-to-static-html/6.0.0: admin Only in /home/deploy/wp-safety.org/data/plugin-versions/export-wp-page-to-static-html/6.0.1: assets @@ -3,7 +3,7 @@ * Plugin Name: Export WP Page to Static HTML * Plugin URI: https://myrecorp.com * Description: Export WP Pages to Static HTML is the most flexible static HTML export plugin for WordPress. Unlike full-site generators, Export WP Pages to Static HTML gives you surgical control — export exactly the posts, pages, or custom post types you need, in the status you want, as the user role you choose. - * Version: 6.0.0 + * Version: 6.0.1 * Author: ReCorp * Author URI: https://www.upwork.com/fl/rayhan1 * License: GPL-2.0+ @@ -19,7 +19,7 @@ add_action('init', function () { load_plugin_textdomain('wp-to-html', false, dirname(plugin_basename(__FILE__)) . '/languages'); }); -define('WP_TO_HTML_VERSION', '6.0.0'); +define('WP_TO_HTML_VERSION', '6.0.1'); define('WP_TO_HTML_PATH', plugin_dir_path(__FILE__)); define('WP_TO_HTML_URL', plugin_dir_url(__FILE__)); define('WP_TO_HTML_EXPORT_DIR', WP_CONTENT_DIR . '/wp-to-html-exports');
Exploit Outline
The exploit involves leveraging the lack of nonce (CSRF token) validation in the plugin's administrative request handlers. An attacker can craft a malicious web page that automatically submits a POST or GET request to the WordPress admin panel (e.g., via a hidden form or background script). If a site administrator visits this malicious page while logged in, their browser will automatically include their session cookies, causing the WordPress site to execute sensitive actions—such as starting a full site export or changing plugin settings—under the administrator's authority without their knowledge or consent.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.