CVE-2025-13606: 
WordPress vulnerability analysis and mitigation

CVE-2025-13606 is a Cross-Site Request Forgery (CSRF) vulnerability in the Export All Posts, Products, Orders, Refunds & Users WordPress plugin by Smackcoders, affecting all versions up to and including 2.19. The flaw allows unauthenticated attackers to export sensitive site data — including user records, email addresses, password hashes, and WooCommerce data — to an attacker-controlled file path on the server, provided they can trick a site administrator into clicking a malicious link. It was published on December 2, 2025, with the CVE assigned by Wordfence. The CVSS v3.1 base score is 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing or incorrect nonce validation on the plugin's parseData function (CWE-352: Cross-Site Request Forgery). Because WordPress nonces are not properly verified before processing export requests, an attacker can craft a forged HTTP request that, when executed in the context of an authenticated administrator's browser session, triggers a full data export. The attacker can specify an arbitrary file path on the server as the export destination, potentially writing sensitive data to a web-accessible location. No authentication or special privileges are required on the attacker's side — only the social engineering of an administrator (Wordfence, ENISA EUVD).

Successful exploitation results in a high confidentiality impact: an attacker can exfiltrate the entire WordPress user database, including email addresses and bcrypt/MD5 password hashes, as well as WooCommerce order and customer data. The exported file can be written to an attacker-specified path on the server, potentially making it directly downloadable from the web root. There is no integrity or availability impact, but the exposure of password hashes enables offline cracking and potential account takeover across the site and any services where users reuse credentials (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction — specifically, tricking a logged-in WordPress administrator into clicking a crafted link — which limits opportunistic mass exploitation (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the "Export All Posts, Products, Orders, Refunds & Users" plugin version ≤ 2.19 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Craft malicious request: Construct a forged HTTP POST request targeting the plugin's parseData AJAX action (e.g., wp-admin/admin-ajax.php?action=<plugin_export_action>) with parameters specifying the desired export type (users, orders, etc.) and an attacker-controlled output file path within the web root.
3. Deliver the payload: Embed the forged request in a malicious webpage, image tag, or link (e.g., via a phishing email or comment on a forum) and trick a logged-in WordPress administrator into visiting or clicking it.
4. Retrieve exported data: Once the administrator's browser executes the forged request, the plugin writes the export file to the specified server path. The attacker then accesses the file directly via HTTP (e.g., https://target.com/wp-content/uploads/export.csv) to download user credentials and WooCommerce data (Wordfence).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/admin-ajax.php with export-related action parameters originating from unusual referrers or external domains.
• File System: Unexpected CSV, XML, or export files appearing in web-accessible directories (e.g., wp-content/uploads/) containing user data or order records, especially with unusual filenames or timestamps.
• Logs: PHP or server error logs referencing the parseData function with unexpected file path parameters.
• Network: Outbound HTTP GET requests from external IPs to newly created export files in the web root shortly after an administrator session was active.

Users should update the Export All Posts, Products, Orders, Refunds & Users plugin to version 2.20 or later, which includes proper nonce validation on the parseData function. The patch is available via the WordPress plugin repository (changeset 3405694). As an interim workaround, administrators can deactivate the plugin until the update is applied, and should review server directories for any unexpected export files that may have been created. Restricting administrator access to trusted networks and enabling multi-factor authentication can reduce the risk of CSRF-based social engineering attacks (Wordfence, WordPress Trac).

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the initial advisory. No notable independent researcher commentary, media coverage, or significant social media discussion has been identified beyond standard vulnerability database aggregation (Wordfence).