Junglewise Threat Intelligence

CVE-2026-7558: Token of Trust Age Verification missing authorization in handle_export_table

CVE-2026-7558 · Severity: medium · CVSS 5.3 · Published 2026-07-09

Executive brief

A security flaw in the Token of Trust WordPress plugin allows unauthorized individuals to download sensitive donation and order data. This plugin is typically used to verify the age and identity of site visitors. An attacker could exploit this to obtain customer order IDs, donation amounts, and internal administrative links, potentially leading to privacy breaches and the exposure of business operations.

Technical details

The vulnerability is classified as a missing authorization (CWE-862) within the handle_export_table() function. This function is incorrectly registered on the WordPress 'init' hook without any capability checks, meaning it executes for every request regardless of the user's authentication status. By appending the 'tot_export_table' GET parameter with a numeric value (0–3) to any site URL, an unauthenticated attacker can trigger a CSV download. The exported data includes WooCommerce order dates, IDs, donation amounts, and administrative order edit URLs. The issue affects all versions up to and including 4.0.2.

Affected products

  • Token of Trust Age Verification & Identity Verification by Token of Trust up to and including 4.0.2

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References