Executive brief
The Export User Data plugin for WordPress, which allows site owners to export member information, contains a security flaw that allows low-level users to delete files from the web server. By setting a specially crafted display name, an attacker can trick the system into deleting critical configuration files when an administrator runs an export. This can lead to a complete site takeover or permanent loss of data.
Technical details
The Export User Data plugin for WordPress is vulnerable to insecure deserialization and arbitrary file deletion in versions up to 2.2.6. The root cause is insufficient validation of file paths within the 'unserialize' function in the helper.php component. An authenticated attacker with subscriber-level permissions can store a crafted serialized 'XLSXWriter' object as their display name. When an administrator subsequently triggers a user data export, the payload is processed, allowing the attacker to delete arbitrary files on the server. Deleting sensitive files like 'wp-config.php' can lead to a full site reset and remote code execution.
Affected products
- qlstudio Export User Data up to, and including, 2.2.6
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory