The Token of Trust Age Verification & Identity Verification plugin for WordPress suffers from a missing authorization flaw (CWE‑862). A function called handle_export_table is executed on every HTTP request because it is hooked to the WordPress init action, and the function performs no capability check. An attacker who is not logged in can simply visit any page on the site with the tot_export_table GET parameter set to a numeric value (0–3) and trigger the export. The resulting CSV contains sensitive WooCommerce donation data such as order dates, order IDs, donation amounts and admin‑only order edit URLs, thereby disclosing donor identities and financial details. The vulnerability is present in all releases up to and including version 4.0.2; later releases are presumed to contain a fix but must be verified. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a remote, unauthenticated web request by appending the tot_export_table parameter to any URL; no credentials or special configuration are required. Successful exploitation reveals confidential donor information, potentially leading to privacy violations and reputational damage.

WordPress sites that have the Token of Trust Age Verification & Identity Verification plugin installed at version 4.0.2 or earlier are impacted. Sites using newer plugin releases are not affected unless a new vulnerability is discovered. The vulnerability affects all websites where the plugin is active and allows unauthenticated users to trigger the CSV export. No other products or versions are reported as affected by this flaw.

The moderate CVSS score reflects that the flaw provides direct access to sensitive data without authentication, but it does not grant arbitrary code execution or system compromise. The low EPSS score indicates that the exploitation rate is currently small, yet the simplicity of the attack—just adding a query parameter—makes it attractive if it is discovered by adversaries. Since the vulnerability is not listed in the KEV catalog, there is no evidence of known exploitation in the wild. Defensive measures such as WAF rules or host‑controlled restrictions can mitigate the risk until the plugin is patched.