CVE-2026-7558

Name of the Vulnerable Software and Affected Versions Age Verification & Identity Verification by Token of Trust versions prior to 4.0.3

Description The plugin is subject to unauthorized access because the handle export table() function is registered on the WordPress 'init' hook without a capability check. This hook executes for all requests, including those from unauthenticated users. An attacker can download a CSV file containing sensitive WooCommerce donation data—such as order dates, order IDs, charitable donation amounts, and admin-only order edit URLs—by accessing any page with the tot export table GET parameter set to a numeric value between 0 and 3.

Recommendations Update the plugin to a version later than 4.0.2. As a temporary mitigation, restrict access to the tot export table parameter to prevent unauthorized data export.