EUVD-2026-95741
GHSA-hvrj-fvj7-h84q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit crafted serialized payload
-
ExploitTrigger unsafe PHP unserialize
-
ExecutionInstantiate malicious object gadget chain
-
ImpactExecute code / compromise site data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session at low privilege (PR:L) - the attacker must hold a valid WordPress account on the target site, so sites allowing open user registration are most exposed; fully anonymous exploitation is not supported by the CVSS vector. The flaw is reachable over the network with no user interaction against the Quiz And Survey Master plugin (quiz-master-next) versions up to and including 11.2.7. Practical impact depends on the presence of a usable PHP gadget chain (from the plugin, WordPress core, or other installed plugins/themes) to convert object injection into code execution or file manipulation, which can vary by installation. |
| Impact | CVSS 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with PHP Object Injection via untrusted deserialization (CWE-502), which commonly escalates to remote code execution or arbitrary file operations on WordPress hosts. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so despite the high CVSS the real-world exploitation signal is currently absent: this reads as a high-severity-but-not-yet-demonstrated issue rather than a confirmed active threat. The PR:L requirement is a meaningful limiter - an attacker needs at least a low-privileged account (e.g., subscriber/contributor), which is realistic on open-registration WordPress sites but excludes fully unauthenticated mass exploitation. Patchstack is the sole reporting source; no independent vendor advisory or patched-version confirmation beyond the 'through 11.2.7' affected range is present in the data, so patch availability should be verified directly with ExpressTech. |
| Exploit ScenarioDerived | An attacker with a low-privilege WordPress account (such as a self-registered subscriber) submits a crafted serialized payload to a vulnerable Quiz And Survey Master endpoint, which PHP unserializes without validation. The resulting PHP Object Injection instantiates attacker-controlled objects that trigger a gadget chain, potentially leading to remote code execution or data compromise on the site. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
PHP Object Injection in the Quiz And Survey Master plugin for WordPress (versions up to 11.2.7) allows an authenticated attacker with low privileges to execute arbitrary code or manipulate files via crafted serialized input. The vulnerability is network-reachable with low complexity and no user interaction, and can lead to full site compromise if a suitable gadget chain is present. No public exploit code has been identified at the time of analysis.
RemediationAI
No vendor-released patch is identified in the available data at this time; however, since the vulnerability affects versions through 11.2.7, updating to a newer version (if available) is recommended, and users should monitor the Patchstack advisory for an official fix. As a compensating control, restrict WordPress user registration and ensure that only trusted users have accounts, because the flaw requires low-privilege authentication. If the plugin is not essential, consider deactivating it temporarily; be aware this may disrupt quiz and survey functionality. Additionally, minimize installed plugins and themes to reduce the availability of gadget chains that could be exploited. Always back up the site before making changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a deserialization of untrusted data (CWE-502) in the ExpressTech Quiz And Survey Master WordPress plugin, commonly known as quiz-master-next. It arises when the plugin passes user-supplied input to PHP's unserialize() function without adequate validation, enabling an attacker to inject arbitrary PHP objects. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires network access, low attack complexity, low-privilege authentication, and no user interaction, with full impact to confidentiality, integrity, and availability. The actual impact depends on the presence of a property-oriented programming (POP) gadget chain in the plugin, WordPress core, or other installed plugins/themes; without such a chain, the attacker may only achieve object injection, but with a chain, remote code execution or arbitrary file operations are possible. The CPE cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:*:*:* indicates the product family, though the vulnerability is confirmed through version 11.2.7.
Know when Quiz And Survey Master gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needs a low-privilege account (PR:L) but no interaction; successful object injection can yield full code/data compromise, hence C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Executive ViewAI
The Quiz And Survey Master plugin for WordPress (versions up to 11.2.7) contains a high-severity PHP Object Injection vulnerability that can lead to full site compromise. Organizations running this plugin on their WordPress sites are at risk of arbitrary code execution or file manipulation by attackers, potentially resulting in data breaches, defacement, or complete loss of site control. No public exploit identified at time of analysis, but leadership should prioritize immediate mitigation given the lack of a vendor patch and the potential for significant business disruption.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the Quiz And Survey Master plugin, restricting access to the plugin's functionality to trusted users, deploying web application firewall (WAF) rules to detect and block serialized input exploitation attempts, and monitoring logs for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Quiz And Survey Master
View allThe Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_i
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the r
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. Rated
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL I
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz s
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Rated critical severity (CVSS 9.8), this v
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields befo
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, w
Exploit-DB