Skip to content
OpenAdvisories

Vendor

qlstudio

1 known vulnerabilities.

Products

Export User Data 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.0
    CVE-2026-12240

    Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field

    The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subsc…

    qlstudio Export User Data Web / CMS