The Export User Data WordPress plugin is vulnerable to PHP Object Injection (CWE-502) through the display_name field. An attacker with at least subscriber‑level permissions can inject a crafted serialized XLSXWriter object; the plugin unserializes the value and performs an insufficient file path check, allowing arbitrary file deletion. If the attacker deletes critical files such as wp-config.php, remote code execution or denial of service can follow. This flaw provides a path to compromise confidentiality and integrity of the server when the deletion is executed.

WordPress installations using the Export User Data plugin version 2.2.6 or earlier are affected. The vulnerability exists on all platforms where the plugin is installed, regardless of server OS, provided the plugin is not upgraded beyond 2.2.6.

The CVSS score of 8 indicates high severity, and while an EPSS score is not listed, the lack of a KEV listing suggests no widely known exploits yet. However, the attack requires only an authenticated user with subscriber or higher role, and the attacker must trigger an export operation while the malicious payload is stored in the display_name. Because this attacker does not need to compromise the administrator account directly, the likelihood of exploitation is non‑trivial in environments with many subscriber accounts.