CVE-2025-11693 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Sensitive info leak via `cookies.txt`. 💥 **Consequences**: Attackers get auth cookies. Leads to full account takeover & data breach. 📉

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-200**: Information Exposure. 🔍 **Flaw**: The plugin publicly exposes `cookies.txt` files. No access control on this specific file. 📂

Q: Who is affected? (Versions/Components)

📦 **Product**: Export WP Page to Static HTML & PDF. 👥 **Vendor**: recorp. 📅 **Affected**: Version **4.3.4 and earlier**. ⚠️

Q: What can hackers do? (Privileges/Data)

🕵️ **Hackers**: Unauthenticated attackers. 🔑 **Data**: Authentication cookies. 🚀 **Impact**: Access sensitive admin data. Bypass login security. 💻

Q: Is exploitation threshold high? (Auth/Config)

⚖️ **Threshold**: Medium. 🔑 **Auth**: No login needed for the file. ⚙️ **Config**: Requires an admin to trigger a backup with specific roles. 🎯

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **PoC**: Yes. 🔗 **Source**: ProjectDiscovery Nuclei templates available. 🌐 **Status**: Publicly documented. Easy to automate. 🤖

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `cookies.txt` exposure. 🛠️ **Tool**: Use Nuclei or manual HTTP requests. 👀 **Feature**: Look for static HTML export artifacts. 📝

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update plugin to **> 4.3.4**. 📢 **Source**: WordPress plugin repo & WordFence intel. ✅ **Status**: Patch available. 🔄

Q: What if no patch? (Workaround)

🚧 **Workaround**: Disable the plugin if not needed. 🔒 **Mitigate**: Restrict file permissions. 👀 **Monitor**: Watch for unauthorized backup triggers. 🛡️

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: HIGH. 📈 **Risk**: CVSS High (C:H, I:H, A:H). ⏳ **Action**: Patch immediately. Don't wait. 🏃♂️

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Sensitive info leak via `cookies.txt`. <br>💥 **Consequences**: Attackers get auth cookies. Leads to full account takeover & data breach. 📉

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-200**: Information Exposure. <br>🔍 **Flaw**: The plugin publicly exposes `cookies.txt` files. No access control on this specific file. 📂

Q3Who is affected? (Versions/Components)

📦 **Product**: Export WP Page to Static HTML & PDF. <br>👥 **Vendor**: recorp. <br>📅 **Affected**: Version **4.3.4 and earlier**. ⚠️

Q4What can hackers do? (Privileges/Data)

🕵️ **Hackers**: Unauthenticated attackers. <br>🔑 **Data**: Authentication cookies. <br>🚀 **Impact**: Access sensitive admin data. Bypass login security. 💻

Q5Is exploitation threshold high? (Auth/Config)

⚖️ **Threshold**: Medium. <br>🔑 **Auth**: No login needed for the file. <br>⚙️ **Config**: Requires an admin to trigger a backup with specific roles. 🎯

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **PoC**: Yes. <br>🔗 **Source**: ProjectDiscovery Nuclei templates available. <br>🌐 **Status**: Publicly documented. Easy to automate. 🤖

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `cookies.txt` exposure. <br>🛠️ **Tool**: Use Nuclei or manual HTTP requests. <br>👀 **Feature**: Look for static HTML export artifacts. 📝

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Update plugin to **> 4.3.4**. <br>📢 **Source**: WordPress plugin repo & WordFence intel. <br>✅ **Status**: Patch available. 🔄

Q9What if no patch? (Workaround)

🚧 **Workaround**: Disable the plugin if not needed. <br>🔒 **Mitigate**: Restrict file permissions. <br>👀 **Monitor**: Watch for unauthorized backup triggers. 🛡️

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: HIGH. <br>📈 **Risk**: CVSS High (C:H, I:H, A:H). <br>⏳ **Action**: Patch immediately. Don't wait. 🏃‍♂️

Continue exploring

Vulnerability detail Full AI analysis (login) recorp CWE-200