LiveActive security incident?Get immediate response
CVE Record

CVE-2023-6369: Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A WordPress plugin used to export pages to static HTML/CSS did not properly check whether logged-in users were allowed to use several admin AJAX functions. A low-privilege account, such as a subscriber, could read some sensitive data or change plugin settings. Impact is limited, but exposed sites with untrusted users should treat it as a real access-control issue.

Executive priority

Prioritize remediation for WordPress sites that allow user registration or have many low-privilege accounts. This is not currently evidenced as exploited, but it can undermine site configuration integrity and expose information from a trusted plugin context.

Technical view

CVE-2023-6369 is a CWE-862 missing authorization flaw in Export WP Page to Static HTML/CSS through version 2.1.9. Multiple AJAX actions lacked capability checks, allowing authenticated subscriber-level users or higher to disclose information or perform unauthorized plugin actions, including saving advanced settings. CVSS 3.1 is 5.4: network reachable, low complexity, low privileges, no user interaction.

Likely exposure

Exposure is mainly WordPress sites running the affected plugin versions and allowing low-privilege authenticated users. Sites with public registration, many subscribers, or shared editorial access have higher practical risk than tightly controlled sites with only trusted administrators.

Exploitation context

The source bundle does not show CISA KEV listing or other evidence of active exploitation. Exploitation requires an authenticated WordPress account with subscriber-level access or above, which limits risk compared with unauthenticated plugin flaws.

Researcher notes

Focus review on missing capability checks across the referenced AJAX request handlers. The changeset is relevant for understanding intended remediation, but the provided bundle does not name a fixed version. Avoid assuming unauthenticated impact; the CVE requires authenticated subscriber-level access or higher.

Mitigation direction

  • Check whether the plugin is installed and at or below version 2.1.9.
  • Review vendor and WordPress plugin guidance for the fixed or recommended version.
  • Update the plugin if a security release is available from the vendor.
  • Disable or remove the plugin if it is not required.
  • Limit subscriber-level access and public registration where business workflows allow.
  • Review plugin settings for unexpected changes after remediation.

Validation and detection

  • Inventory WordPress sites for Export WP Page to Static HTML/CSS installations.
  • Confirm installed plugin versions against the affected range through 2.1.9.
  • Verify low-privilege users cannot access plugin AJAX actions without authorization.
  • Review recent plugin configuration changes and export logs for anomalies.
  • Confirm remediation through a staging test before production rollout.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-862: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-6369 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2023-6369Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
recorpExport WordPress Pages to Static HTML & PDF — Static Site Export0unaffected
Weakness

CWE details

CWE-862

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-862 · source CWE mapping

Missing Authorization

Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs