CVE-2025-13606

Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19. This is due to missing or incorrect nonce validation on the `parseData` function. This makes it possible for unauthenticated attackers to export sensitive information including user data, email addresses, password hashes, and WooCommerce data to an attacker-controlled file path on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected

smackcoders · Export All Posts, Products, Orders, Refunds & Users

CVSS v3.1 WORDFENCE

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS

0.16% chance of exploitation in the next 30 days, 5th percentile

Published

2025-12-02

Updated

2026-04-08

Proof-of-concept exploits (1)

• ghostnetsecurity/API-Hole-PoC0★ · 2025-12-08

References

• CVE Record
• NVD entry