EUVD-2026-57939
GHSA-fv8g-mjfh-5j9v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote unauthenticated code injection with no interaction gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact; code executes within the web app context so I assess S:U rather than the reported S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
AnalysisAI
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is that a target WordPress site has the QA Heatmap Analytics plugin (version ≤ 5.2.0.0) installed and activated and is reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and no special configuration are required, so this is remote unauthenticated exploitation against default installations of the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every hard signal points to maximum severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact and a scope change, yielding the ceiling score of 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the QA Heatmap Analytics plugin to a version later than 5.2.0.0 as published on the Patchstack advisory and the WordPress plugin repository; an exact fixed version number is not provided in the available data, so confirm the patched release directly against the vendor/Patchstack listing (https://patchstack.com/database/wordpress/plugin/qa-heatmap-analytics/vulnerability/wordpress-qa-analytics-plugin-5-2-0-0-remote-code-execution-rce-vulnerability) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations to identify those running QA Analytics plugin version 5.2.0.0 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Qa Analytics
View allSame weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today