Executive brief
The Ezoic WordPress plugin, used to optimize site performance and ad delivery, contains a critical access control flaw that allows attackers without authentication to export the entire site database, including user password hashes, password reset tokens, and site configuration secrets. Attackers can also persistently modify plugin settings to maintain access and escalate the attack. This puts customer data, account security, and site integrity at immediate risk.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the plugin's REST API endpoints for content export. Unauthenticated attackers can POST to /wp-json/ezoic-emote/v1/export/initiate and /wp-json/ezoic-cms/v1/export/initiate without proper authorization checks. The attack chain involves: (1) triggering an export via an unauthenticated REST call, (2) optionally persisting the CMS module activation via the X-Ezoic-CMS header to unlock additional export functionality, and (3) accessing exported files directly if they land in a web-accessible directory (wp-content/). The exported data includes wp_users.csv with password hashes and reset tokens, wp_options.csv with authentication keys, and full database dumps. No rate limiting exists, enabling repeated extractions and denial of service. Fixed in version 2.23.1.
Affected products
- Ezoic WordPress Plugin 2.6.35 to 2.23.0
Timeline
- 2026-08-10: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched: Fixed in version 2.23.1