The Export Categories plugin for WordPress is affected by a critical missing authorization vulnerability that permits unauthorized access to sensitive plugin functions.

This is a CWE-862 Missing Authorization flaw where the plugin fails to perform necessary capability checks on its export functionality. The CVSS vector of AV:N/AC:L/PR:N/UI:N indicates that the flaw is exploitable by unauthenticated remote attackers without requiring user interaction.

The ability for unauthenticated users to trigger export functions can lead to unauthorized data exposure, potentially leaking administrative or site content that should remain protected. With a CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and should be treated with high urgency to prevent information disclosure.

Immediate Action: As no official patch is currently identified, users should immediately deactivate and uninstall the Export Categories plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests directed at plugin-specific endpoints or export-related URLs that originate from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access attempts targeting the plugin's export functionality if immediate removal is not feasible.

Public Exploit Available: Unknown.

Given the severity of this access control failure, administrators must prioritize the removal of the Export Categories plugin. Because the vulnerability allows unauthenticated access, the risk of automated scanning and exploitation is elevated. Monitor vendor channels closely for future security releases, but do not re-enable the plugin until a verified fix is confirmed.