CVE-2026-12240 is a CWE-502 deserialization vulnerability in the Export User Data plugin for WordPress by qlstudio, affecting all versions up to and including 2.2.6. The vulnerability arises from insufficient file path validation in the unserialize function, enabling authenticated attackers with subscriber-level privileges or higher to delete arbitrary files on the server. Exploitation requires an administrator to initiate a user data export while a malicious serialized XLSXWriter object payload is present in a subscriber's display name. This can lead to remote code execution if critical files like wp-config.php are deleted.

An attacker with subscriber-level access or higher can delete arbitrary files on the server by exploiting this vulnerability. This can cause denial of service or enable remote code execution if key files such as wp-config.php are deleted. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level users from storing serialized objects in display names and avoid triggering user data exports when untrusted data may be present. Monitor vendor channels for official patches or updates.