CVE-2026-12240 describes a vulnerability in the Export User Data WordPress plugin by qlstudio, affecting all versions up to and including 2.2.6. The vulnerability arises from insecure deserialization of untrusted data via the unserialize function, which lacks sufficient file path validation. Authenticated attackers with subscriber-level privileges can craft a serialized XLSXWriter object payload stored in their display name. When an administrator triggers a user data export, this payload can cause arbitrary file deletion on the server. Deleting sensitive files such as wp-config.php can enable remote code execution. The vulnerability is rated high severity (CVSS 8.0) and no patch or official fix has been documented as of the published date.

An attacker with subscriber-level or higher access can delete arbitrary files on the server by exploiting the deserialization flaw. This can lead to remote code execution if critical files are deleted, severely compromising the affected WordPress installation's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and avoid triggering user data exports when untrusted user data may contain malicious serialized payloads.