QA Analytics CVE-2026-27544

The only prerequisite is that a target WordPress site has the QA Heatmap Analytics plugin (version ≤ 5.2.0.0) installed and activated and is reachable over the network; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and no special configuration are required, so this is remote unauthenticated exploitation against default installations of the plugin. Exploitation is limited only by whether the plugin is present and internet-exposed - sites without this specific plugin, or with it deactivated/removed, are not affected, and network filtering or a WAF in front of the plugin's endpoints raises the bar.

Every hard signal points to maximum severity: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact and a scope change, yielding the ceiling score of 10.0. There is no CISA KEV listing and no published proof-of-concept in the provided data, so this is not confirmed as actively exploited - EPSS and SSVC data were not supplied and cannot be cited. Even so, pre-authentication RCE in an internet-facing WordPress plugin is exactly the class attackers mass-scan and weaponize quickly once a POC surfaces, so even a mid-sized municipal IT team in tczew should treat this as urgent rather than deferring it to a routine cycle. Absence of KEV/POC evidence should be read as 'not yet observed,' not 'low risk'; the realistic risk is high and should drive immediate patching.

An attacker scanning the internet for the QA Heatmap Analytics plugin sends a single crafted HTTP request to a vulnerable plugin endpoint with a malicious payload in an unsanitized parameter, causing the server to execute attacker-supplied code with no login required. From there the attacker drops a web shell, exfiltrates the WordPress database and secrets, and pivots deeper into the hosting environment. No public proof-of-concept is identified at time of analysis, but the low attack complexity means exploitation would be straightforward once code is developed.