The vulnerability in the WP All Export plugin arises from a PHP type juggling flaw in the security token comparison. The code compares the provided token against a stored MD5 hash prefix using loose equality (==) instead of strict comparison (===). When the expected MD5 prefix matches a numeric‑looking pattern (^0e\d+$), an attacker can supply a magic hash value that passes the comparison. This bypasses authentication checks and allows unauthenticated users to invoke the export download endpoint, retrieving sensitive export files that may contain personally identifiable information, business data, or database contents. The weakness is classified as CWE-200, indicating a potential for unauthorized disclosure of information.

This flaw affects any WordPress site using the soflyy WP All Export plugin, specifically versions 1.4.14 and earlier. Users running the plugin in these versions are at risk of unauthorized data exfiltration through the export download endpoint.

The CVSS score is 3.7, signifying low severity, and the EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Adversaries can exploit it remotely by sending a crafted HTTP request to the download endpoint with a magic hash value; no credentials are required. While the probability of exploitation remains low, the potential impact is the exposure of sensitive information.