CVE-2022-2638: Export All URLs < 4.4 - Admin+ Arbitrary System File Removal

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-29 · updated 2026-06-17
Weakness: CWE-73

Description

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

Affected products

Export All URLs: before 4.4 — fixed in 4.4

How to fix

Upgrade to a fixed version: Export All URLs 4.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/70840a72-ccdc-4eee-9ad2-874809e5de11
https://wpscan.com/vulnerability/70840a72-ccdc-4eee-9ad2-874809e5de11

Get alerted when CVE-2022-2638 or the next vulnerability affects your stack