Security readout for executives and security teams
Plain-English summary
CVE-2026-1582 affects the WP All Export WordPress plugin up to and including 1.4.14. In limited circumstances, an unauthenticated attacker could bypass an export download check and retrieve export files. Those files may contain personal, business, or database information. The published severity is low because successful exploitation depends on a hard-to-hit hash condition.
Executive priority
Treat as a targeted data-exposure cleanup item, not an emergency takeover risk. Prioritize sites that handle customer, employee, financial, or database exports. Update promptly during the next maintenance window, remove stale exports, and review logs if sensitive exports were present.
Technical view
The issue is a sensitive information exposure flaw in the export download endpoint. The token check used loose PHP comparison rather than strict comparison, enabling type-juggling bypass when the expected MD5-derived value has a numeric-looking form. The CVSS is 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. WordPress Trac shows a related code change in changeset 3455775.
Likely exposure
Exposure is most likely on internet-accessible WordPress sites running WP All Export version 1.4.14 or earlier and retaining downloadable export files. Risk depends on whether sensitive exports exist and whether the vulnerable endpoint is reachable. The CVE metadata contains some affected-version inconsistency, so teams should verify against vendor and plugin repository information.
Exploitation context
No active exploitation is stated in the provided sources, and the CVE is not listed as KEV in the supplied data. Exploitation is unauthenticated but high complexity because it depends on a specific token/hash condition. Impact is confidentiality-only: unauthorized download of export data, not code execution or site takeover.
Researcher notes
The core evidence points to CWE-200 caused by PHP loose comparison in the export download flow. The supplied affected metadata is internally inconsistent, while the title and description state versions through 1.4.14. Avoid assuming broader product impact. The Trac source and changeset are the best public artifacts for code-level verification.
Mitigation direction
- Update WP All Export to the latest vendor-supported release.
- Confirm the installed version includes the WordPress Trac fix changeset 3455775.
- Remove unnecessary stored export files from the site.
- Limit access to export outputs where operationally feasible.
- Monitor vendor and Wordfence guidance for corrected affected-version details.
Validation and detection
- Inventory WordPress sites using WP All Export.
- Record installed plugin versions and compare with 1.4.14.
- Review whether export files contain PII, business data, or database content.
- Check web logs for unexpected unauthenticated export download activity.
- Verify post-update code uses strict token comparison.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-1582 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/wp-all-export/tags/1.4.14/actions/wp_loaded.php#L19CVE reference
- https://plugins.trac.wordpress.org/changeset/3455775/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.