plugin

Export User Data Vulnerabilities

2 known security issues reported for the Export User Data WordPress plugin. Most recent disclosed Jul 28, 2026.

2 high

Running Export User Data on your site? Check whether your installed version is affected.

Scan your site free

Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection

high

The Export User Data plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnera...

CVSS:
7.5
Affected:
up to 2.2.6
Fix:
No patched version reported
Disclosed:
Jul 28, 2026

CVE-2026-65552 on NVD →

Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field

high

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on th...

CVSS:
8
Affected:
up to 2.2.6
Fix:
No patched version reported
Disclosed:
Jun 29, 2026

CVE-2026-12240 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database