Description

Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:17.430Z",
  "pubdate": "2026-08-06T15:17:17.430Z",
  "executiveSummary": "A PHP Object Injection vulnerability has been identified in the Export User Data plugin affecting versions <= 2.2.6. This security flaw arises from the insecure handling of serialized data and lack of proper input validation during the export process. An authenticated remote attacker possessing low-privileged Subscriber access can exploit this vulnerability by supplying crafted malicious input to the application, which is subsequently deserialized without adequate security controls.\nThe primary impact of this vulnerability includes potential arbitrary code execution, unauthorized data access, file deletion, or Server-Side Request Forgery depending on the presence of compatible gadget chains within the PHP application environment and included libraries. Given the exploitation requirements, an attacker must authenticate at the Subscriber level to interact with the vulnerable functionality. The risk implications are severe, as successful exploitation could lead to full compromise of the underlying WordPress installation. Organizations utilizing affected versions of Export User Data should prioritize remediation to mitigate potential malicious actions executed within the application context.",
  "technicalDetails": "The vulnerability is rooted in the insecure deserialization of untrusted user input within the Export User Data plugin for versions <= 2.2.6. PHP Object Injection occurs when user-supplied input is passed directly into the unserialize() function without prior sanitization or validation, allowing attackers to manipulate internal object states and instantiate arbitrary classes present in the namespace or included third-party libraries.\nThe attack flow begins when an authenticated user with Subscriber privileges sends a maliciously crafted HTTP request targeting the vulnerable component of the Export User Data plugin. This input typically contains a serialized PHP payload designed to exploit existing classes that implement magic methods such as __wakeup() or __destruct(). Upon processing the request, the vulnerable function passes the untrusted input to the deserialization routine, triggering the execution of the embedded gadget chain.\nAuthentication is required to reach the vulnerable endpoint, specifically requiring at least Subscriber-level privileges within the WordPress environment. The network exposure is standard HTTP/HTTPS reachable via the web application interface. The payload behavior depends on the specific gadget chains available in the target environment, but commonly results in arbitrary file read/write, remote code execution, or database manipulation. Post-exploitation impact ranges from privilege escalation to complete system takeover, as the execution occurs within the security context of the PHP process executing the web application."
}