A critical PHP object injection vulnerability in the Export User Data plugin for WordPress allows unauthenticated attackers to achieve remote code execution and full system compromise.

This flaw stems from improper deserialization of untrusted data (CWE-502). It permits unauthenticated attackers to inject malicious PHP objects into the application, potentially leading to arbitrary code execution.

The exploitation of this vulnerability poses a severe threat to business operations, as it grants attackers the ability to execute arbitrary code with the privileges of the web server. This can lead to total system compromise, unauthorized access to sensitive user data, and significant reputational damage. With a CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent full service takeover.

Immediate Action: As no official patch is currently available, administrators should immediately deactivate and remove the Export User Data plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious serialized strings or unusual PHP error patterns that might indicate attempted deserialization attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious object injection attempts, though this should be considered a temporary measure until the software is removed or updated.

Public Exploit Available: Unknown

Given the critical nature of this deserialization flaw and the absence of a vendor-provided fix, the risk is unacceptably high. Organizations must prioritize the removal of this plugin from their WordPress environments immediately to prevent potential unauthorized access and system exploitation.