CVE Catalog
CVE-2026-65552
CriticalCVSS 9.8Summary
Subscriber PHP Object Injection in Export User Data versions up to 2.2.6.
Risk Assessment
A user with the subscriber role can inject malicious PHP objects, potentially leading to privilege escalation or code execution.
Recommendation
Update the Export User Data plugin to the latest version that addresses this vulnerability.
Original NVD description (English source)
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.