CVE-2026-1582: WP All Export Auth Bypass Vulnerability

CVE-2026-1582 Overview

The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This vulnerability stems from a PHP type juggling weakness in the security token comparison, which uses loose comparison (==) instead of strict comparison (===). This flaw allows unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), enabling unauthorized download of sensitive export files containing PII, business data, or database information.

Critical Impact

Unauthenticated attackers can bypass security token validation and download sensitive export files containing personally identifiable information (PII), business data, and database contents without any authentication.

Affected Products

• WP All Export plugin for WordPress versions up to and including 1.4.14

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-1582 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1582

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in PHP's type juggling behavior when comparing security tokens. When the plugin validates download requests for export files, it compares user-supplied tokens against expected MD5 hash values using PHP's loose comparison operator (==).

PHP's loose comparison has well-documented weaknesses when comparing strings that appear to be numbers in scientific notation. If an MD5 hash begins with 0e followed only by digits (e.g., 0e123456789), PHP interprets this as zero in scientific notation (0 × 10^n = 0). An attacker can exploit this by supplying any string that also evaluates to zero under loose comparison, effectively bypassing the authentication check.

This attack requires the target export's security token hash to match the vulnerable pattern ^0e\d+$, which occurs in approximately 1 in 300 million MD5 hashes. While the attack complexity is high due to this prerequisite, successful exploitation grants complete access to potentially sensitive exported data.

Root Cause

The root cause is improper comparison of security-sensitive values in wp_loaded.php at line 19. The plugin uses PHP's loose comparison operator (==) instead of the strict comparison operator (===) when validating security tokens for export file downloads. This introduces a type juggling vulnerability that allows magic hash collisions to bypass authentication entirely.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can target the export download endpoint with crafted "magic hash" values. The exploitation flow involves:

1. Identifying WordPress sites using the WP All Export plugin version 1.4.14 or earlier
2. Locating export file download endpoints
3. Submitting authentication bypass payloads using known PHP magic hash values (strings that evaluate to 0e0 under loose comparison)
4. If the target export's security token happens to have a hash matching the vulnerable pattern, authentication is bypassed
5. Downloading the export file containing potentially sensitive information

The vulnerability manifests in the security token validation logic where loose comparison allows type juggling attacks. For detailed technical analysis of the vulnerable code path, see the WordPress Plugin Source Code and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-1582

Indicators of Compromise

• Unexpected access to export download endpoints from external IP addresses
• Multiple failed or successful requests to /wp-content/plugins/wp-all-export/ endpoints with suspicious token parameters
• Download of export files by unauthenticated users or from unfamiliar IP addresses
• Access log entries showing requests with known PHP magic hash values such as 240610708, QNKCDZO, or aabg7XSs

Detection Strategies

• Monitor web server access logs for requests targeting WP All Export download endpoints with unusual token parameters
• Implement web application firewall (WAF) rules to detect and block known magic hash exploitation attempts
• Review authentication logs for export file access patterns that bypass normal user authentication flows
• Deploy endpoint detection solutions to identify unauthorized data exfiltration from WordPress installations

Monitoring Recommendations

• Enable verbose logging for the WP All Export plugin to capture all download attempts
• Configure alerting for any unauthenticated access to export file endpoints
• Regularly audit exported data files to identify potential unauthorized access or data exposure
• Implement file integrity monitoring on the WordPress plugins directory

How to Mitigate CVE-2026-1582

Immediate Actions Required

• Update WP All Export plugin to a version newer than 1.4.14 immediately
• Review web server access logs for any suspicious access to export download endpoints
• Audit all exported files to determine if sensitive data may have been exposed
• Temporarily disable the WP All Export plugin if an update is not immediately available
• Rotate any security tokens or credentials that may have been exposed in export files

Patch Information

The vulnerability has been addressed in versions newer than 1.4.14. The fix involves replacing loose comparison (==) with strict comparison (===) for security token validation. Review the WordPress Changeset Details for complete patch information. Update through the WordPress plugin repository or download the patched version directly from the official WordPress plugins directory.

Workarounds

• Implement web application firewall rules to block requests with known PHP magic hash values targeting export endpoints
• Restrict access to the WP All Export plugin's export download functionality via .htaccess or server configuration to trusted IP addresses only
• Disable the export download feature if not actively needed until the plugin can be updated
• Move any existing export files to a non-web-accessible location and serve them through authenticated administrative functions only

# Apache .htaccess rule to restrict access to WP All Export exports
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} wp-all-export [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. 
    RewriteRule .* - [F,L]
</IfModule>