The Export All URLs WordPress plugin prior to version 5.1 creates CSV export files named with a predictable pattern that includes a random 6-digit number. These files, which contain URLs of all posts including private ones, are saved in the publicly accessible wp-content/uploads/ directory. Because the filename pattern is guessable, an unauthenticated attacker can brute-force the filenames to retrieve these CSV files and gain access to sensitive URL information. This constitutes an information exposure vulnerability classified under CWE-200. The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only.

An unauthenticated attacker can access sensitive URLs, including private post URLs, by guessing the filenames of exported CSV files stored in a public directory. This exposure can lead to unauthorized disclosure of potentially sensitive content URLs. There is no impact on data integrity or availability. No known exploits are reported in the wild.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the wp-content/uploads/ directory or disabling the Export All URLs plugin if sensitive data exposure is a concern.