The Token of Trust Age Verification & Identity Verification plugin for WordPress contains a missing authorization flaw (CWE‑862). A function called handle_export_table is hooked to WordPress’s init action and is executed for every HTTP request, even those from users who are not logged in. Because the function performs no capability check, an attacker can simply append the tot_export_table GET parameter with a numeric value (0–3) to any page URL. The plugin then emits a CSV file that includes sensitive WooCommerce donation data such as order dates, order IDs, donation amounts and admin‑only order edit URLs, effectively exposing donor identities and financial information.

WordPress sites that have the Token of Trust Age Verification & Identity Verification plugin installed at version 4.0.2 or earlier are impacted. The description does not state that later releases contain the fix, so sites using newer versions cannot be assumed secure until they are verified to be patched.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw through a remote, unauthenticated web request by visiting any page on the site with the ‘tot_export_table’ parameter set; no credentials or special configuration are required. Successful exploitation reveals confidential donor information, potentially violating privacy regulations and eroding customer trust.