Executive brief
A vulnerability exists in the Export WP Page to Static HTML/CSS plugin for WordPress, which is used to convert dynamic site content into static files. An attacker could trick a site administrator into performing unintended actions, such as changing plugin settings or triggering exports, by getting them to click a malicious link. This could lead to unauthorized configuration changes or disruption of the site's static export process.
Technical details
The Export WP Page to Static HTML/CSS plugin for WordPress (versions up to and including 6.0.0) is vulnerable to Cross-Site Request Forgery (CSRF). This occurs due to missing or insufficient nonce validation on administrative functions. An unauthenticated attacker can craft a malicious request and trick a logged-in administrator into executing it via social engineering (e.g., a phishing link). Successful exploitation allows the attacker to perform actions on behalf of the administrator, such as modifying plugin settings. The issue is resolved in version 6.0.1.
Affected products
- Recorp Export WP Page to Static HTML/CSS <= 6.0.0
Timeline
- 2025-12-22: other: Reported by Nabil Irawan
- 2026-05-25: disclosed: Published by Patchstack
- 2026-05-25: patched: Fixed in version 6.0.1