The WP All Export plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) due to improper token validation in the export download endpoint. Specifically, the plugin uses a loose comparison operator (==) for verifying security tokens, which allows PHP type juggling attacks. When the expected MD5 hash prefix matches a pattern resembling a numeric value (e.g., ^0e\d+$), an attacker can craft a 'magic hash' to bypass authentication checks and download sensitive export files containing PII or other confidential data. This vulnerability affects all versions up to and including 1.4.14. The CVSS 3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An unauthenticated attacker can bypass the security token check due to a PHP type juggling vulnerability and download sensitive export files from the WP All Export plugin. The exposed data may include personally identifiable information, business data, or database contents. The impact is limited to confidentiality loss with no integrity or availability impact. The vulnerability has a low severity rating and no known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the export download endpoint and monitor for unauthorized access attempts. Avoid relying on the affected plugin versions for sensitive data exports. Follow vendor updates closely for any released patches or official fixes.