CVE-2023-5905: High Missing Authorization in Export Posts With Images

CVE-2023-5905 is a high severity (CVSS 8.1 in the record) missing authorization flaw in the DeMomentSomTres WordPress Export Posts With Images plugin, through version 20220825. Any logged-in user, even a subscriber, can export the blog, including unpublished posts. WPScan lists no known fix, so remove the plugin.

What's affected

• Plugin: DeMomentSomTres WordPress Export Posts With Images, through version 20220825.
• Fixed version: none. WPScan says there is no known fix.
• Severity: 8.1 High in the NVD record. WPScan scores the same flaw 6.5 Medium. The sources differ, so use the higher figure for planning.
• What leaks: restricted and unpublished posts, and the passwords of password protected posts.
• Credit: WPScan credits Krzysztof Zając of CERT Polska.

How to check if you're exposed

In the WordPress admin, open Plugins and read the version shown under DeMomentSomTres WordPress Export Posts With Images. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:

wp plugin list --fields=name,title,version,status,update

Find the row for DeMomentSomTres WordPress Export Posts With Images and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder name is often demomentsomtres-wp-export.

If the plugin is installed at any version, treat the site as exposed. Also check how many accounts exist, because every registered user can reach the export, including subscribers who signed up on an open registration form.

What to do now

1. Deactivate and delete the plugin. No fixed release exists.
2. If you still need export features, use WordPress core export under Tools, which is limited to administrators.
3. Close open user registration if you do not need it, or set the default role to the lowest one.
4. Review any drafts, private posts and password protected posts, and change passwords on protected posts, since their passwords could have been read.
5. Check the user list for accounts you do not recognize.

Why it matters

The plugin exports blog content on request but never asks whether the requester is allowed to do that. The record classes it as CWE-862, missing authorization. Authentication is present, since the user must be logged in, but authorization is absent, because nothing checks the user's role.

That difference trips up many plugins. A login wall does not protect an action if every logged-in user can perform it, and many sites let anyone register. The leak covers material the owner marked as not public: drafts, private posts and the passwords on protected ones. WPScan reports no fix, which makes removal the only complete answer. The record does not list this CVE as known exploited.

Quick check

Sources

• CVE-2023-5905 on Gold
• WPScan: DeMomentSomTres Export Posts With Images

Last reviewed: 19 October 2026.