EUVD-2026-53980
GHSA-3vc2-373x-2487
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity object injection, but the Patchstack 'Subscriber' label indicates a low-privileged account is required, so PR:L rather than PR:N; full C/I/A impact assumed via a POP gadget chain.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
Articles & Coverage 1
AnalysisAI
PHP Object Injection in the Export User Data WordPress plugin (versions up to and including 2.2.6) allows attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. Reported by Patchstack (EUVD-2026-53980) and rated CVSS 9.8, though the Patchstack title labels it a 'Subscriber' issue, implying a low-privileged account is actually required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching a code path in Export User Data ≤2.2.6 that passes attacker-controlled input to PHP unserialize(), and - for meaningful impact - the presence of a usable POP gadget chain in the plugin, WordPress core, or another installed plugin (object injection alone is inert without a gadget). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a network, unauthenticated, low-complexity path to full compromise, which would make this critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers (or already holds) a low-privileged account on a WordPress site running Export User Data ≤2.2.6, then submits a request to a plugin endpoint containing a crafted serialized PHP object. When the plugin deserializes the input, a POP gadget chain in the environment is triggered, allowing the attacker to write files, tamper with data, or execute code and take over the site. … |
| Remediation | No vendor-released patch version was identified in the provided data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/export-user-data/vulnerability/wordpress-export-user-data-plugin-2-2-6-php-object-injection-vulnerability) and upgrade to any release newer than 2.2.6 once published; if none exists yet, deactivate and remove the Export User Data plugin until a fix ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for Export User Data plugin versions up to 2.2.6; disable the plugin immediately if not mission-critical, and restrict Subscriber account creation or access to trusted users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today