CVE-2026-12240: WordPress Export User Data Path Traversal

CVE-2026-12240 Overview

CVE-2026-12240 is an arbitrary file deletion vulnerability in the Export User Data plugin for WordPress affecting all versions up to and including 2.2.6. The flaw stems from insufficient file path validation in the plugin's unserialize call, which processes user-controlled data during export operations. Authenticated attackers with subscriber-level access or higher can store a crafted serialized XLSXWriter object as their display name. When an administrator subsequently triggers a user data export, the object is deserialized and can delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to remote code execution by forcing WordPress into a state where attacker-controlled setup routines execute.

Critical Impact
Authenticated low-privilege users can achieve remote code execution on affected WordPress sites by inducing deletion of wp-config.php through an administrator-triggered export.

Affected Products

Export User Data plugin for WordPress, all versions through 2.2.6
WordPress sites with subscriber registration enabled and the plugin installed
Any WordPress deployment where administrators periodically export user data using the plugin

Discovery Timeline

2026-06-30 - CVE-2026-12240 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-12240

Vulnerability Analysis

The vulnerability is a PHP Object Injection issue classified under [CWE-502] Deserialization of Untrusted Data. The Export User Data plugin passes attacker-influenced content to PHP's unserialize function without validating that the resulting object graph is safe to instantiate. The XLSXWriter class, present in the plugin's dependency chain, contains destructor or cleanup logic that removes files referenced by object properties. By controlling those properties through a crafted serialized payload, an attacker directs the file deletion to any path the web server user can access.

Successful exploitation requires two conditions. First, an attacker must hold a subscriber account or higher and set their display name to a serialized payload. Second, an administrator must trigger the user export action that invokes the vulnerable code path in library/core/helper.php.

Root Cause

The root cause is unsafe deserialization of stored user profile data. The plugin treats the display name field as trusted structured data and calls unserialize on it during export processing. PHP object destructors then execute against attacker-supplied property values, enabling arbitrary file deletion outside any intended plugin scope.

Attack Vector

Exploitation is network-based and requires authentication at the subscriber level plus user interaction from an administrator. The attacker registers or uses an existing low-privilege account, updates the display name to a serialized XLSXWriter payload referencing the target file path, and waits for an administrator to run the export. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the vulnerable code location and disclosure details.

Detection Methods for CVE-2026-12240

Indicators of Compromise

User accounts with display names containing serialized PHP object markers such as O:10:"XLSXWriter" or other class-prefixed serialization tokens
Unexpected absence of wp-config.php, .htaccess, or plugin files following an administrator export action
WordPress fatal errors or setup-wizard prompts appearing after a routine user data export
Web server error log entries referencing missing core WordPress files immediately after export activity

Detection Strategies

Query the wp_users table for display_name values matching the regex ^[aOs]:\d+: to surface serialized payloads stored in profile fields
Enable file integrity monitoring on the WordPress document root and alert on deletion of wp-config.php, wp-load.php, and plugin bootstrap files
Correlate WordPress admin export_user_data actions with subsequent file system delete events on the host

Monitoring Recommendations

Audit user registration events and profile updates for non-printable characters or suspicious length in the display name field
Log all invocations of the Export User Data plugin and record the initiating administrator, timestamp, and affected user set
Monitor filesystem unlink syscalls on the WordPress installation directory using host-based tooling

How to Mitigate CVE-2026-12240

Immediate Actions Required

Deactivate the Export User Data plugin until a fixed version is installed if any patched release is available from the vendor
Audit all existing user accounts and remove or sanitize any display_name values that appear to contain serialized PHP objects
Restrict new user registration or require administrator approval to limit the ability of attackers to seed payloads
Back up wp-config.php and other critical files outside the web root to enable rapid recovery

Patch Information

At the time of publication, no fixed version is referenced in the CVE record. Consult the Wordfence Vulnerability Report and the plugin page on WordPress.org for the latest remediation status and update the plugin to the first version above 2.2.6 that addresses the deserialization flaw.

Workarounds

Disable the plugin and use an alternative export mechanism that does not deserialize profile data
Apply a web application firewall rule that blocks profile updates where the display_name parameter matches PHP serialization patterns
Enforce least privilege on the web server user so it cannot delete WordPress core files such as wp-config.php
Remove subscriber-level self-registration on sites where it is not required

bash

# Configuration example: WordPress hardening and integrity monitoring
wp plugin deactivate export-user-data
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
auditctl -w /var/www/html/wp-config.php -p wa -k wp_config_change