The 'Export All Posts, Products, Orders, Refunds & Users' WordPress plugin by smackcoders contains a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in the parseData function. This flaw allows unauthenticated attackers to craft malicious requests that, when executed by an administrator, export sensitive site data including user details and WooCommerce information to a location controlled by the attacker. The vulnerability affects all plugin versions up to 2.19. The CVSS 3.1 score of 6.5 reflects the medium severity of this vulnerability, with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Successful exploitation can result in unauthorized export of sensitive information such as user data, email addresses, password hashes, and WooCommerce-related data. This exposure can compromise user privacy and site security. The attack requires an administrator to be tricked into performing an action, but no prior authentication is needed for the attacker. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable plugin version. Implementing additional CSRF protections or nonce validation in the plugin code may mitigate the risk. Monitor official smackcoders communications for updates and patches.