This vulnerability in the Export WP Page to Static HTML/CSS WordPress plugin arises from missing authorization checks on certain functionality. As a result, unauthenticated attackers can access features that should be protected by ACLs. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to confidentiality loss without integrity or availability effects. The affected versions include all releases up to 4.1.0.

An attacker can access functionality in the plugin without proper authorization, potentially exposing information that should be restricted. The impact is limited to confidentiality loss; there is no reported impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality through other means such as web application firewalls or access control at the server level. Monitor vendor channels for updates and apply patches promptly once available.