The vulnerability in the Export All Posts, Products, Orders, Refunds & Users plugin allows unauthenticated attackers to inject a PHP object during a deserialization process in the returnMetaValueAsCustomerInput function. Because the plugin uses the PHP unserialize() function on data that can be controlled by external actors, a crafted serialized payload can create an arbitrary PHP object when processed. While the plugin itself does not contain a protected object property (POP) chain, the injected object can be leveraged by other POP-capable plugins or themes on the same site to delete files, read sensitive data, or execute arbitrary code, depending on the available chain.

The vulnerability affects all WordPress installations that have SMACKcoders’ Export All Posts, Products, Orders, Refunds & Users plugin version 2.13 or earlier. Any site using the plugin in a vulnerable state is at risk; versions released after 2.13 have no known instance of this issue.

The technical risk is reflected in a CVSS base score of 9.8 and an EPSS of 2 %, indicating a high likelihood of exploitation but not extreme. Attackers can reach the vulnerable code over the network via unauthenticated HTTP requests. The absence of an internal POP chain reduces the immediacy of the risk, but the presence of any POP-capable plugin or theme on the same site transforms the vulnerability into a high‑severity remote code execution vector. The vulnerability is not listed in the CISA KEV catalog.