https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:47:11.376290+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-286568 EUVD-2026-286568 2026-10-06T07:47:11.422478+00:00 EUVD-2026-286568 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1582 fkie_cve-2026-1582 2026-10-06T07:47:11.422560+00:00

The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.

 https://cve.radiocsirt.org/vuln/ghsa-p4q3-g549-vvfc GHSA-p4q3-g549-vvfc 2026-10-06T07:47:11.422599+00:00

The WP All Export plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.14 via the export download endpoint. This is due to a PHP type juggling vulnerability in the security token comparison which uses loose comparison (==) instead of strict comparison (===). This makes it possible for unauthenticated attackers to bypass authentication using "magic hash" values when the expected MD5 hash prefix happens to be numeric-looking (matching pattern ^0e\d+$), allowing download of sensitive export files containing PII, business data, or database information.