What is the CVSS score of CVE-2026-65552?

CVE-2026-65552 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Export User Data are affected by CVE-2026-65552?

Export User Data WordPress plugin (versions ≤2.2.6) contains a critical remote code execution vulnerability allowing Subscriber-level users to compromise site integrity and escalate to complete site…

How to fix or mitigate CVE-2026-65552?

Within 24 hours: Audit all WordPress installations for Export User Data plugin versions up to 2.2.6; disable the plugin immediately if not mission-critical, and restrict Subscriber account creation or access to trusted users only. Within 7 days: Monitor Patchstack and the plugin vendor for patch availability; implement Web Application Firewall (WAF) rules to detect serialized object payloads if feasible, and review audit logs for suspicious Subscriber activity. Within 30 days: Deploy the patched version to all affected systems immediately upon release, conduct a full security audit to identify unauthorized access, and revoke Subscriber accounts created during the exposure period.

Export User Data CVE-2026-65552

EUVD-2026-53980 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-3vc2-373x-2487

PHP WordPress Deserialization Wordpress Plugin Export User Data

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity object injection, but the Patchstack 'Subscriber' label indicates a low-privileged account is required, so PR:L rather than PR:N; full C/I/A impact assumed via a POP gadget chain.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:54 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Export User Data WordPress Plugin - CVE-2026-65552 Aug 07, 2026

AnalysisAI

PHP Object Injection in the Export User Data WordPress plugin (versions up to and including 2.2.6) allows attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. Reported by Patchstack (EUVD-2026-53980) and rated CVSS 9.8, though the Patchstack title labels it a 'Subscriber' issue, implying a low-privileged account is actually required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-502 Deserialization of Untrusted Data (PHP Object Injection) in a WordPress plugin whose purpose is exporting registered user records. PHP object injection occurs when unsanitized input reaches unserialize(), letting an attacker instantiate arbitrary PHP objects; if a 'POP' (Property-Oriented Programming) gadget chain exists in the plugin, WordPress core, or another loaded plugin, magic methods such as __wakeup() or __destruct() can be abused to achieve file writes, SQL injection, or code execution. The affected CPE is cpe:2.3:a:qstudio:export_user_data (vendor qstudio), and the Deserialization/PHP tags confirm the root cause is untrusted serialized data being passed to PHP's deserializer rather than a memory-safety bug.

RemediationAI

No vendor-released patch version was identified in the provided data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/export-user-data/vulnerability/wordpress-export-user-data-plugin-2-2-6-php-object-injection-vulnerability) and upgrade to any release newer than 2.2.6 once published; if none exists yet, deactivate and remove the Export User Data plugin until a fix ships. As compensating controls, restrict or disable new user self-registration (Settings > General > 'Anyone can register') to remove the low-privileged account prerequisite, deploy a WordPress WAF/virtual patch (Patchstack or equivalent) to block serialized-object payloads to the plugin's endpoints, and limit access to the plugin's export functionality to trusted administrators; note that disabling registration may break membership/e-commerce sign-up flows and a WAF virtual patch is a stopgap, not a code fix.