CVE-2026-1582

The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wp-all-export/tags/1.4.14/actions/wp_loaded.php#L19
https://plugins.trac.wordpress.org/changeset/3455775/
https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-18 13:16

Updated : 2026-06-17 10:16

NVD link : CVE-2026-1582

Mitre link : CVE-2026-1582

CVE.ORG link : CVE-2026-1582

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-1582", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1582", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T20:23:21.585955Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "soflyy", "product": "WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.14"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-18T13:16:20.340", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-all-export/tags/1.4.14/actions/wp_loaded.php#L19", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3455775/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using \"magic hash\" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\\d+$), allowing download of sensitive export files containing PII, business data, or database information."}, {"lang": "es", "value": "El plugin WP All Export para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 1.4.14, inclusive, a trav\u00e9s del endpoint de descarga de exportaci\u00f3n. Esto se debe a una vulnerabilidad de manipulaci\u00f3n de tipos de PHP en la comparaci\u00f3n del token de seguridad que utiliza una comparaci\u00f3n laxa (==) en lugar de una comparaci\u00f3n estricta (===). Esto hace posible que atacantes no autenticados eludan la autenticaci\u00f3n utilizando valores de 'magic hash' cuando el prefijo del hash MD5 esperado resulta ser de aspecto num\u00e9rico (coincidiendo con el patr\u00f3n ^0e\\d+$), permitiendo la descarga de archivos de exportaci\u00f3n sensibles que contienen PII, datos comerciales o informaci\u00f3n de la base de datos."}], "lastModified": "2026-06-17T10:16:06.570", "sourceIdentifier": "security@wordfence.com"}