CVE-2026-12240

Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7

Description Insufficient file path validation in the unserialize() function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. This occurs when an administrator triggers a user data export while a malicious user has stored a crafted serialized XLSXWriter object payload within their display name. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update the plugin to a version newer than 2.2.6.