Sensitive Information Exposure in WP All Export Plugin for WordPress

CVE-2026-1582

What is CVE-2026-1582?

The WP All Export plugin for WordPress is susceptible to a vulnerability that exposes sensitive information through the export download endpoint. This issue arises from a PHP type juggling flaw where a loose comparison operator is employed during security token verification. This flaw allows attackers to exploit specific 'magic hash' values to bypass authentication, particularly if the expected MD5 hash prefix appears numeric. As a result, this can lead to unauthorized downloading of sensitive files, including personally identifiable information (PII) and other critical business data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References