What is the CVSS score of EUVD-2026-17816?

EUVD-2026-17816 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-17816?

Yes, a patch is available for EUVD-2026-17816. Update the affected software to the latest version immediately.

WordPress EUVD-2026-17816

| CVE-2026-2696 MEDIUM

Information Exposure (CWE-200)

2026-04-01 contact@wpscan.com

GHSA-j528-c652-pjv3

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.1

EUVD ID Assigned

Apr 01, 2026 - 06:22 euvd

EUVD-2026-17816

Analysis Generated

Apr 01, 2026 - 06:22 vuln.today

CVE Published

Apr 01, 2026 - 06:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.

AnalysisAI

Export All URLs WordPress plugin before version 5.1 exposes private post URLs and sensitive data through predictably named CSV export files stored in the publicly accessible wp-content/uploads/ directory, allowing unauthenticated attackers to enumerate and retrieve these files via brute-force attacks against a simple 6-digit filename pattern.

Technical ContextAI

The Export All URLs plugin implements a CSV export function that generates output files with predictable names based on a 6-digit random number appended to a standard filename pattern. The vulnerability stems from insufficient filename randomization and improper access controls. While no CWE is explicitly provided in the input data, this pattern aligns with CWE-330 (Use of Insufficiently Random Values) and CWE-434 (Unrestricted Upload of File with Dangerous Type). The files are stored in wp-content/uploads/, which is conventionally configured as a publicly accessible web directory in WordPress installations. The plugin fails to implement adequate directory-level access restrictions (such as .htaccess rules or web server configuration) that would prevent direct URL enumeration, allowing attackers to construct predictable file paths and retrieve exported data containing private post information that should not be publicly accessible.

RemediationAI

Update the Export All URLs WordPress plugin to version 5.1 or later immediately via the WordPress admin dashboard (Plugins > Updates) or by downloading the patched version from wpscan.com. Administrators unable to update immediately should restrict direct access to the wp-content/uploads/ directory using web server configuration (Apache .htaccess or Nginx location blocks) to require authentication, or move exported CSV files to a non-publicly-accessible directory once generated. Review server logs and the wp-content/uploads/ directory to identify any previously exported files containing sensitive data and remove them. As a precaution, regenerate any private post URLs if exported files are suspected to have been accessed by unauthorized parties.