WordPress Plugin Arbitrary File Deletion via Insecure Deserialization

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Export User Data plugin for WordPress contains a critical insecure deserialization vulnerability (CWE-502) affecting all versions through 2.2.6. Authenticated attackers with subscriber-level or higher permissions can exploit insufficient file path validation in the unserialize function to delete arbitrary files from the server. This vulnerability is particularly dangerous because deleting sensitive files like wp-config.php can directly enable remote code execution, effectively compromising the entire WordPress installation. Any organization running this plugin faces significant risk, as the barrier to exploitation is low—requiring only basic user account access that attackers may already possess or easily obtain.

Casky's 446 matched skills leverage Claude AI with extended reasoning to detect the attack chain across three MITRE ATT&CK tactics: Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002). Practitioners using Casky would identify suspicious patterns including: (1) serialized PHP object manipulation attempts in plugin parameters or uploaded data, (2) file system reconnaissance queries targeting wp-config.php and other critical WordPress files, (3) unusual file deletion operations from low-privileged user contexts, and (4) post-deletion execution activity indicating successful RCE. The platform's skill mapping would surface indicators of compromise specific to unserialize abuse, helping security teams correlate web logs showing suspicious POST requests to the plugin with subsequent file system modifications and shell upload attempts—enabling rapid detection and response before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12240.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-12240

Casky has 446 skills that investigate the attack patterns behind CVE-2026-12240. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn