CVE-2026-7558: CWE-862 Missing Authorization in tokenoftrust Age Verification & Identity Verification by Token of Trust
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4.0.2. This is due to the handle_export_table() function being registered on the WordPress 'init' hook, which fires for all requests, including those from unauthenticated visitors, without any capability check. This makes it possible for unauthenticated attackers to download a CSV file containing sensitive WooCommerce donation data, including order dates, order IDs, charitable donation amounts, and admin-only order edit URLs, simply by visiting any page on the site with the 'tot_export_table' GET parameter set to a numeric value (0–3).
AI Analysis
Technical Summary
CVE-2026-7558 is a missing authorization vulnerability (CWE-862) in the Token of Trust plugin for WordPress, specifically in the Age Verification & Identity Verification component. The handle_export_table() function is registered on the 'init' hook, which executes on every request without verifying user permissions. As a result, attackers can access a CSV export of sensitive WooCommerce donation data by visiting any page with the 'tot_export_table' GET parameter set to a numeric value between 0 and 3. This vulnerability affects all versions up to and including 4.0.2.
Potential Impact
An unauthenticated attacker can obtain sensitive WooCommerce donation information including order dates, order IDs, charitable donation amounts, and URLs intended only for admin order editing. This exposure can lead to information disclosure but does not impact data integrity or availability. The CVSS 3.1 base score of 5.3 reflects a medium impact primarily due to confidentiality loss without requiring privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's export functionality by disabling or removing the 'tot_export_table' GET parameter handling or applying custom access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply official patches once released.
CVE-2026-7558: CWE-862 Missing Authorization in tokenoftrust Age Verification & Identity Verification by Token of Trust
Description
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4.0.2. This is due to the handle_export_table() function being registered on the WordPress 'init' hook, which fires for all requests, including those from unauthenticated visitors, without any capability check. This makes it possible for unauthenticated attackers to download a CSV file containing sensitive WooCommerce donation data, including order dates, order IDs, charitable donation amounts, and admin-only order edit URLs, simply by visiting any page on the site with the 'tot_export_table' GET parameter set to a numeric value (0–3).
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7558 is a missing authorization vulnerability (CWE-862) in the Token of Trust plugin for WordPress, specifically in the Age Verification & Identity Verification component. The handle_export_table() function is registered on the 'init' hook, which executes on every request without verifying user permissions. As a result, attackers can access a CSV export of sensitive WooCommerce donation data by visiting any page with the 'tot_export_table' GET parameter set to a numeric value between 0 and 3. This vulnerability affects all versions up to and including 4.0.2.
Potential Impact
An unauthenticated attacker can obtain sensitive WooCommerce donation information including order dates, order IDs, charitable donation amounts, and URLs intended only for admin order editing. This exposure can lead to information disclosure but does not impact data integrity or availability. The CVSS 3.1 base score of 5.3 reflects a medium impact primarily due to confidentiality loss without requiring privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's export functionality by disabling or removing the 'tot_export_table' GET parameter handling or applying custom access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-30T19:30:10.370Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4f598a68715ace43f21ad2
Added to database: 07/09/2026, 08:19:22 UTC
Last enriched: 07/16/2026, 10:20:48 UTC
Last updated: 08/21/2026, 12:11:08 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.