CVE-2026-65552

Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7

Description The Export User Data plugin for WordPress allows authenticated attackers with subscriber-level access and above to perform PHP Object Injection. This occurs through the deserialization of untrusted input, a process where a stored string is converted back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the plugin, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 2.2.6.