CVE-2026-12240
Received Received - Intake

Arbitrary File Deletion in Export User Data WordPress Plugin

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: Wordfence

Description
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-06-30
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-12240
EUVD
EUVD-2026-40260

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
export_user_data plugin to 2.2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Export User Data plugin for WordPress has a vulnerability due to insufficient file path validation in the unserialize function in all versions up to and including 2.2.6.

This flaw allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.

Exploitation requires an administrator to trigger a user data export while a subscriber-level or higher user has stored a specially crafted serialized XLSXWriter object payload as their display name.

Impact Analysis

This vulnerability can lead to the deletion of arbitrary files on the server by an attacker with subscriber-level access.

If critical files such as wp-config.php are deleted, it can result in remote code execution, which poses a severe security risk.

The CVSS score of 8.0 indicates a high severity impact, including confidentiality, integrity, and availability being compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart