Export User Data CVE-2026-12240

Exploitation requires three concrete conditions: (1) the attacker holds at least a subscriber-level authenticated account (PR:L) on a site running Export User Data ≤ 2.2.6; (2) the attacker stores a crafted serialized XLSXWriter object payload as their account display name; and (3) an administrator subsequently triggers the plugin's user-data export feature (the UI:R interaction), which invokes the vulnerable unserialize() path. Limiting factors that reduce real-world risk: the export must be initiated by a higher-privileged victim, so the attacker cannot fire the chain alone; the site must both run the vulnerable plugin and permit the attacker to obtain a subscriber account (e.g., open registration); and success depends on knowing/targeting a deletable high-value path such as wp-config.php.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) signals network reachability with low attacker privileges but a required user interaction - and that interaction is the critical gating factor: a separate administrator must trigger a user-data export for the gadget to fire. No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so all real-world-exploitation signals are currently absent or unknown. SSVC-style reading: technical impact is total (file deletion → potential RCE via wp-config.php), but the attack is NOT automatable end-to-end because it depends on victim admin action, lowering practical urgency relative to the high CVSS. Net: a genuinely serious bug class on any site running this plugin, but the admin-trigger dependency makes it more opportunistic than mass-exploitable; priority is high where the plugin is installed and admins routinely export user data.

A subscriber-level account is created on a WordPress site and sets its display name to a crafted serialized XLSXWriter PHP object whose magic method deletes wp-config.php. Later, an administrator runs the plugin's user-data export, which unserializes the malicious display name and deletes the target file; with wp-config.php gone, the attacker can drive WordPress into setup mode and pivot to remote code execution. No public proof-of-concept is referenced, and the network/low-complexity vector means the only real hurdle is waiting for or socially prompting an admin export.