PT-2026-20386 · WordPress · Wordpress+1

Vincent Theriault-Laine · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-1582

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP All Export plugin for WordPress versions prior to 1.4.15

Description The WP All Export plugin for WordPress is susceptible to exposure of sensitive information in versions up to and including 1.4.14. This occurs through the export download endpoint due to a PHP type juggling issue. The security token comparison utilizes loose comparison (==) instead of strict comparison (===). This allows unauthenticated attackers to bypass authentication using specific "magic hash" values when the expected MD5 hash prefix appears numeric. Successful exploitation enables the download of sensitive export files, potentially containing personally identifiable information (PII), business data, or database information. The vulnerable endpoint is '/export download'. The comparison involves a security token, and the issue stems from the use of loose comparison with the == operator.

Recommendations Update WP All Export plugin to version 1.4.15 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-1582

Produtos afetados

Wp All Export

Wordpress

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1582 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wp-all-export/tags/1.4.14/actions/wp_loaded.php#L19 · Nota
• https://twitter.com/CVEnew/status/2024104652229267724 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3455775 · Nota