External risk intelligence

Subscriber PHP Object Injection in Export User Data Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65552

The vulnerability exists in a WordPress plugin used for exporting user data. WordPress plugins are typically deployed within web applications that are commonly exposed to the public internet to facilitate site management or data accessibility, making this surface frequently reachable.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a popular WordPress plugin that handles user data exports. This issue could allow unauthorized individuals to remotely inject malicious code into systems, potentially leading to significant data compromise and system disruption. The main concern is confirming whether our organization utilizes this specific plugin and, if so, assessing our exposure.

Code injection vulnerability in data export tool.
Critical risk if this plugin is in use.
Confirm plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable WordPress site. This request targets the "Export User Data" plugin, exploiting a weakness in how it handles subscriber data. If successful, the attacker could gain unauthorized access to sensitive information and potentially disrupt the application.

No authentication required.
Triggered via crafted requests.
Leads to data exposure and disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Export User Data plugin could allow an unauthenticated attacker to inject malicious PHP objects into the application. This injection could potentially lead to the disclosure of sensitive information, modification of data, or disruption of service when the plugin's export functionality is utilized.

System data could be affected.
Injection can occur through the plugin's export feature.
May lead to data compromise or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Export User Data plugin requires immediate attention from teams responsible for web application security and WordPress instance management. The first practical step is to identify all instances of the plugin, determine their reachability and business criticality, and then assign ownership for remediation. This process will involve coordinating with application owners, infrastructure teams, and potentially vendor management if the plugin was acquired through a third party.

Application owners should prioritize remediation.
Verify plugin reachability and business criticality.
Plan and execute mitigation or removal.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Export User Data WordPress plugin?

Export User Data is a WordPress plugin designed to allow administrators or users to extract site information into portable formats. It simplifies moving or backing up database entries, such as user profiles, for site management purposes. Because it directly handles site data and interacts with system processes to package this information for export, it requires secure handling of all incoming inputs to prevent unauthorized system operations.

What is a PHP Object Injection vulnerability in CVE-2026-65552?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. It occurs when the plugin takes data provided by a user and converts it back into a PHP object without proper verification. By sending a malicious string instead of legitimate data, an attacker can trick the system into creating objects it did not intend to, which can then be used to execute unauthorized commands or manipulate application logic.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending a specially crafted request to the WordPress site that the plugin processes. Because the vulnerability does not require any login credentials, the attacker does not need to be a registered user to initiate the attack. Simply browsing to or interacting with the plugin's specific functionality is enough, provided the request contains the malicious data payload designed to exploit the deserialization weakness.

Is my site at risk if it uses this plugin?

According to Halo Surface Signal, this plugin is often deployed in web applications that are reachable via the public internet to support site management tasks. Because the attack vector is network-based and requires no authentication, any WordPress instance with this plugin installed and accessible to the web is at higher risk. Internal-only sites may have a lower profile, but any system where the plugin is enabled and reachable from the network should be considered potentially exposed.

What should I do if I find this plugin on my system?

Start by identifying all instances of the plugin within your WordPress environment and determine their current business use. Reach out to the application owners to assess the criticality of the plugin's functionality. Your primary goal is to confirm whether you are running a vulnerable version (2.2.6 or lower) and coordinate with your team to plan for updates, temporary disabling, or removal of the plugin to mitigate the risk of unauthorized access.

References

patchstack.com/database/wordpress/plugin/export-user-data/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.