EUVD-2026-40260
GHSA-ww5c-p3qw-8xxf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Subscriber auth gives PR:L over the network (AV:N/AC:L), but the chain only fires on an admin-triggered export (UI:R); arbitrary deletion of files like wp-config.php yields C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.
Articles & Coverage 1
AnalysisAI
Arbitrary file deletion in the Export User Data plugin for WordPress (versions up to and including 2.2.6) allows an authenticated subscriber-level attacker to delete any file on the server, including wp-config.php, which can escalate to remote code execution. The flaw stems from unsafe deserialization of a PHP object embedded in a user's display name that is processed when an administrator exports user data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation is gated by required administrator interaction.
Technical ContextAI
The affected component is the Export User Data plugin (CPE cpe:2.3:a:qlstudio:export_user_data) built in PHP for WordPress. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin's export routine (per the trac reference, library/core/helper.php around line 171) calls PHP unserialize() on attacker-influenced data - specifically a serialized XLSXWriter object stored in a low-privileged user's display name. When PHP instantiates that object graph, magic methods (e.g., __destruct/__wakeup) on the XLSXWriter class act as a POP (Property-Oriented Programming) gadget that performs a filesystem delete using an attacker-controlled path, because the file path is not validated before the destructive operation occurs.
RemediationAI
No vendor-released patch identified at time of analysis - the available references point only to the Wordfence advisory and the vulnerable 2.2.6 source, not to a fixed tagged release, so monitor the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/39f12ff1-63ee-4131-a708-49633f22ccd4?source=cve) and upgrade as soon as a version above 2.2.6 is published. As immediate compensating controls, deactivate and remove the Export User Data plugin until a fix ships (trade-off: loses export functionality); if it must stay active, instruct administrators to avoid running the user-data export feature, which is the trigger (trade-off: blocks legitimate exports); restrict or vet new low-privilege user registrations and sanitize/validate display-name fields for users who can self-register, since the payload is staged in the display name; and ensure wp-config.php and other critical files are protected by least-privilege filesystem permissions and backed up so deletion does not become catastrophic RCE.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today