CVE-2026-7558: Token of Trust WordPress Plugin Unauthorized Data Export Vulnerability

Technical summary

The vulnerability exists in the handle_export_table() function, which is hooked to the WordPress 'init' action at the global level. Because 'init' fires for every request before authentication checks, and the function contains no capability verification (such as current_user_can()), unauthenticated users can trigger CSV data exports by appending ?tot_export_table=[0-3] to any site URL. The exported CSV contains WooCommerce donation records including order dates, order IDs, donation amounts, and admin-only order edit URLs. This is a classic authorization bypass stemming from missing access controls on a publicly-callable function.

Business impact

Organizations running this plugin face potential exposure of donor information and charitable contribution history—data that may be sensitive, confidential, or subject to privacy regulations. Disclosure of donation amounts and donor activity could undermine donor privacy, damage organizational reputation, and create compliance risks if the site is subject to GDPR, CCPA, or sectoral privacy laws. The exposure of admin edit URLs may also facilitate secondary attacks by revealing WordPress administrative paths.

Affected systems

Any WordPress installation using the Age Verification & Identity Verification by Token of Trust plugin at version 4.0.2 or earlier is vulnerable. The plugin appears commonly deployed on sites accepting charitable donations via WooCommerce. No distinction in risk exists across WordPress versions or hosting environments; the flaw affects all installations regardless of WordPress core version or server configuration.

Exploitability

Exploitation requires only network access and no authentication—an attacker simply crafts a request with the tot_export_table parameter set to 0, 1, 2, or 3 and receives a CSV download of sensitive data. No user interaction, social engineering, or complex techniques are needed. The attack surface is extremely broad: any visitor, bot, or automated scanner can trigger the export. This represents a low-complexity, no-authentication vulnerability suitable for opportunistic reconnaissance.

Remediation

Update the Age Verification & Identity Verification by Token of Trust plugin to a patched version released after 4.0.2. Verify the vendor advisory for the exact patched version number and deployment timeline. As an interim mitigation, consider disabling the plugin entirely, restricting site access via Web Application Firewall (WAF) rules that block requests containing 'tot_export_table' in the query string, or moving the affected site offline pending patch availability. If plugin deactivation is not feasible, confirm with the vendor the expected patch release date.

Patch guidance

Check the plugin's official WordPress.org repository or vendor website for version 4.0.3 or later. Apply the patch as soon as it becomes available, testing first in a staging environment to ensure compatibility with your WooCommerce configuration and any custom donation workflows. Verify that the patched version includes capability checks (e.g., current_user_can('manage_options')) before allowing export functionality. After patching, audit access logs for evidence of unauthorized export requests using the tot_export_table parameter.

Detection guidance

Search web server and WordPress access logs for requests containing 'tot_export_table' in the query string, particularly those from non-administrator IP ranges. Monitor for GET requests to your site's root or donation pages with the parameter set to 0–3. Correlate timestamps with donation data access to identify potential compromise windows. Use WordPress security plugins (such as Wordfence or Sucuri) to monitor for suspicious plugin activity. Implement WAF rules to alert on tot_export_table requests. If compromised data is suspected, review exported CSV timestamps and cross-reference with donation platform audit trails to confirm the scope of exposure.

Why prioritize this

Although the CVSS score of 5.3 (Medium) reflects the lack of integrity or availability impact, the vulnerability carries elevated practical risk because it exposes highly sensitive donor and order data without any barrier to exploitation. Sites accepting charitable contributions or membership donations should treat this as higher priority than the numeric score suggests, especially if subject to privacy regulations or donor confidentiality agreements. The ease of exploitation and breadth of exposure merit rapid patching even in medium-risk environments.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a vulnerability with network attack vector, low attack complexity, no privilege requirement, and no user interaction—all favorable to the attacker. However, the impact is limited to confidentiality (Low); there is no integrity or availability impact. The score does not capture the reputational and regulatory harm of donor data exposure, which may exceed the numeric baseline in organizations handling sensitive charitable information. The lack of KEV (Known Exploited Vulnerability) status indicates no verified active exploitation in the wild at publication, but the trivial nature of the attack means exploitation could begin immediately.

Frequently asked questions