CVE-2025-11693: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in recorp Export WordPress Pages to Static HTML & PDF — Static Site Export
The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'
AI Analysis
Technical Summary
CVE-2025-11693 is a critical vulnerability in the Export WP Page to Static HTML & PDF WordPress plugin by recorp, affecting all versions up to 4.3.4. The issue arises from publicly exposed cookies.txt files that contain authentication cookies. When a site administrator initiates a backup with specific user roles, these cookies may be injected into log files accessible without authentication. This exposure allows unauthorized actors to obtain sensitive authentication information, potentially compromising site security. The vulnerability is categorized under CWE-200 for sensitive information exposure and has a CVSS score of 9.8, reflecting its high impact and ease of exploitation.
Potential Impact
An unauthenticated attacker can access publicly exposed cookies.txt files containing authentication cookies, which may lead to unauthorized access to the WordPress site with elevated privileges. This exposure compromises confidentiality, integrity, and availability of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). The vulnerability could allow attackers to fully compromise the site if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided at this time. Until an official fix is available, administrators should avoid triggering backups that expose cookies.txt files and restrict access to backup and log files. Monitor vendor communications for updates and apply official patches or temporary fixes as soon as they are released.
CVE-2025-11693: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in recorp Export WordPress Pages to Static HTML & PDF — Static Site Export
Description
The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-11693 is a critical vulnerability in the Export WP Page to Static HTML & PDF WordPress plugin by recorp, affecting all versions up to 4.3.4. The issue arises from publicly exposed cookies.txt files that contain authentication cookies. When a site administrator initiates a backup with specific user roles, these cookies may be injected into log files accessible without authentication. This exposure allows unauthorized actors to obtain sensitive authentication information, potentially compromising site security. The vulnerability is categorized under CWE-200 for sensitive information exposure and has a CVSS score of 9.8, reflecting its high impact and ease of exploitation.
Potential Impact
An unauthenticated attacker can access publicly exposed cookies.txt files containing authentication cookies, which may lead to unauthorized access to the WordPress site with elevated privileges. This exposure compromises confidentiality, integrity, and availability of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). The vulnerability could allow attackers to fully compromise the site if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided at this time. Until an official fix is available, administrators should avoid triggering backups that expose cookies.txt files and restrict access to backup and log files. Monitor vendor communications for updates and apply official patches or temporary fixes as soon as they are released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-10-13T15:49:19.732Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 693cef62d977419e584a4fcc
Added to database: 12/13/2025, 4:45:22 AM
Last enriched: 4/9/2026, 9:07:20 AM
Last updated: 5/8/2026, 9:28:14 PM
Views: 251
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.