Ezoic lets unauthenticated visitors export the site database
Ezoic from 2.6.35 before 2.23.1 leaves Ezoic_Content_Export::check_headers() effectively disabled. An unauthenticated POST to /wp-json/ezoic-cms/v1/export/initiate reaches initiate_export_event(), run_or_schedule_export() and export(), which exports database tables and packages and uploads the archive; the advisory states that password hashes and password-reset tokens are included. Other content routes also use unrestricted permission callbacks, and X-Ezoic-CMS and X-Emote request headers can persistently change plugin settings. The archive retrieval destination and required Ezoic account-link state are not disclosed.
- Component
- Ezoic
- Plugin slug
ezoic-integration- Affected
- 2.6.35 to < 2.23.1
- Safe version
2.23.1- Published
- Aug 12, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 12, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update to 2.23.1 or later immediately. Remove exposed exports, review plugin settings and public requests, invalidate password-reset tokens and sessions, and reset credentials for affected accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N