qlstudio Export User Data Plugin up to 2.2.6 on WordPress wp-config.php unserialize deserialization

Summaryinfo

A vulnerability categorized as problematic has been discovered in qlstudio Export User Data Plugin up to 2.2.6 on WordPress. The impacted element is the function unserialize of the file wp-config.php. Executing a manipulation can lead to deserialization. This vulnerability appears as CVE-2026-12240. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in qlstudio Export User Data Plugin up to 2.2.6 on WordPress. This vulnerability affects the function unserialize of the file wp-config.php. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.

The weakness was presented by Webbernaut. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-12240 since 06/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:wp-config.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.2.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40260). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• qlstudio

Name

• Export User Data Plugin

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion