The Export and Import Users and Customers plugin for WordPress up to version 2.6.2 is vulnerable to PHP Object Injection through untrusted deserialization of the form_data parameter. An attacker who can authenticate with Administrator privileges can inject a crafted PHP object. The plugin itself does not provide a privilege‑escalation or remote‑code‑execution chain, so the vulnerability is only useful if another component on the site contains a deserialization (POP) chain that can be leveraged.

Affected systems are WordPress installations that use the Webtoffee Import/Export Users and Customers plugin version 2.6.2 or earlier. The vulnerability applies to any WordPress site, including those running WooCommerce or other e‑commerce configurations where the plugin is installed.

The CVSS score of 7.2 indicates a high severity risk when the conditions are met. The EPSS score of <1% shows that the likelihood of exploitation is extremely low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated admin session and the presence of another plugin or theme with a POP chain; only then can the attacker destroy files, steal data, or execute arbitrary code. Without such a chain, the fault is effectively non‑exploitable.