# CVE-2025-11693: Export WordPress Pages to Static HTML & PDF — Static Site Export - Information Disclosure

> Live exploitation tracking for CVE-2025-11693 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-11693

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Recorp Export WordPress Pages to Static HTML & PDF — Static Site Export
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** wordpress, cms

## Description

The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'

## CrowdSec analysis

[CVE-2025-11693](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-11693) is a critical information disclosure vulnerability in the Export WordPress Pages to Static HTML & PDF plugin, affecting all versions up to 4.3.4. This flaw exposes authentication cookies via publicly accessible cookies.txt files, potentially allowing unauthenticated attackers to hijack administrator sessions and gain unauthorized access to sensitive areas of the WordPress site.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-11693 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by directly requesting the `/wp-content/uploads/exported_html_files/cookie.txt` endpoint, which may expose authentication cookies if present, leading to potential account compromise. The attack targets publicly accessible `cookie.txt` files generated by the Export WP Page to Static HTML plugin.

## Timeline

- 2025-12-13: CVE Published. CVE-2025-11693 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2025-11693 exploitation attempts against the CrowdSec Network.
- 2026-08-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-11693 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11693.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-11693) follows observed exploitation activity for CVE-2025-11693. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.