Description

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T06:20:22.817Z",
  "pubdate": "2026-08-12T06:20:22.817Z",
  "executiveSummary": "An unauthenticated access control vulnerability exists in the Ezoic WordPress plugin before version 2.23.1.\nThe flaw allows remote, unauthenticated attackers to invoke improper access restriction controls on internal content export functionality.\nSuccessful exploitation enables unauthorized database exports containing sensitive information such as user password hashes and password reset tokens, alongside the persistent modification of core plugin settings.\nThe risk implication is critical, as exposure of cryptographic password hashes facilitates offline brute-force attacks against user accounts, while persistent configuration tampering can lead to complete site integrity compromise.\nNo prior authentication or privileged access is required by the threat actor to execute the attack vector, lowering the barrier to exploitation significantly.",
  "technicalDetails": "The root cause of the vulnerability stems from missing or inadequate authorization checks within the content export functionality of the Ezoic WordPress plugin.\nThe vulnerable component fails to validate whether incoming requests originate from authenticated administrators or authorized users prior to executing administrative routines.\nThe affected product is the Ezoic WordPress plugin, specifically all versions prior to 2.23.1.\nAttackers interact with the plugin over the network via standard HTTP requests, exploiting the lack of authentication and privilege requirements on the target endpoint.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request directed at the unprotected export endpoint exposed by the Ezoic plugin. Upon receiving the request, the server executes the export routine without validating session tokens or user capabilities. The software then compiles and returns a server-side export of the site database containing sensitive records, including user password hashes and password reset tokens.\nIn addition to data exfiltration, the same lack of access restriction permits attackers to submit arbitrary parameters that persistently alter sensitive plugin configurations.\nPost-exploitation impact includes unauthorized acquisition of cryptographic credentials, enabling credential stuffing and offline hash cracking, as well as persistent unauthorized modification of system settings which may lead to further application compromise or data manipulation."
}