Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter

Vulnerability

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2. The flaw occurs because the plugin deserializes untrusted input from the form_data parameter without proper sanitization, allowing an attacker to inject arbitrary PHP objects. The vulnerability is present in the free version of the plugin as listed on WordPress.org [1].

Exploitation

An attacker must have Administrator-level access (or above) to the WordPress site to exploit this issue. The attacker crafts a serialized PHP object payload within the form_data parameter and submits it through the plugin's administrative interface. No other user interaction is required beyond the authenticated action. There is no known POP (Property-Oriented Programming) chain within the plugin itself, meaning exploitation relies on the presence of another plugin or theme on the same site that contains a suitable POP chain [1].

Impact

If a POP chain is available through an additional plugin or theme, a successful PHP Object Injection can allow the attacker to perform arbitrary actions such as deleting files, retrieving sensitive data, or executing arbitrary code. The impact depends entirely on the capabilities of the POP chain present. Without a POP chain, the vulnerability cannot be directly exploited to affect confidentiality, integrity, or availability [1].

Mitigation

The vulnerability has been patched in version 2.7.3 of the plugin (last updated 2026-05-07) [1]. Users are strongly advised to update to this version or later. No workaround is available for versions 2.6.2 and earlier; the only effective mitigation is to remove or update the plugin. The plugin is not listed on the CISA KEV catalog as of the publication date.