PT-2026-20386 · WordPress · Wordpress+1

Vincent Theriault-Laine · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1582

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP All Export plugin for WordPress versions prior to 1.4.15

Description The WP All Export plugin for WordPress is susceptible to exposure of sensitive information in versions up to and including 1.4.14. This occurs through the export download endpoint due to a PHP type juggling issue. The security token comparison utilizes loose comparison (==) instead of strict comparison (===). This allows unauthenticated attackers to bypass authentication using specific "magic hash" values when the expected MD5 hash prefix appears numeric. Successful exploitation enables the download of sensitive export files, potentially containing personally identifiable information (PII), business data, or database information. The vulnerable endpoint is '/export download'. The comparison involves a security token, and the issue stems from the use of loose comparison with the == operator.

Recommendations Update WP All Export plugin to version 1.4.15 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1582

Affected Products

Wp All Export

Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1582 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-all-export/tags/1.4.14/actions/wp_loaded.php#L19 · Note
• https://twitter.com/CVEnew/status/2024104652229267724 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3455775 · Note