What the vulnerability does
01Description
The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.
Explanation of Vulnerability in Simple Terms
02Summary
WP All Export versions up to 1.4.14 expose limited sensitive information through the plugin's export functionality. An attacker on the network can trigger conditions that leak data without authentication, though the attack requires specific technical circumstances. The exposure is limited to low-sensitivity information. Update to a version newer than 1.4.14.
What an attacker can do
03Attacker Capabilities
Read limited sensitive information from the site without logging in.
Potential impact on your site
04Site Impact
Sensitive data may be exposed to unauthenticated attackers under specific conditions.
Conditions required to exploit
05Prerequisites
Network access; specific technical conditions must be met (high attack complexity).
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
