What is the CVSS score of CVE-2026-59544?

CVE-2026-59544 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-59544?

The Thrive Quiz Builder WordPress plugin contains a critical PHP object injection vulnerability affecting versions 10.9.3.0 and earlier that enables unauthenticated attackers to achieve remote code…

How to fix or mitigate CVE-2026-59544?

Within 24 hours, inventory all WordPress instances to identify whether Thrive Quiz Builder plugin version 10.9.3.0 or earlier is installed and immediately disable the plugin on affected sites to eliminate the attack surface. Within 7 days, audit server logs and database records for exploitation attempts targeting the plugin's deserialization functions, and implement web application firewall (WAF) rules to block requests containing serialized PHP object payloads. Within 30 days, evaluate permanent alternatives to this plugin or establish a vendor accountability timeline for patch delivery; establish continuous monitoring for CVE-2026-59544 updates, and conduct a full security assessment of any systems that previously ran the plugin.

PHP CVE-2026-59544

EUVD-2026-48197 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-23 Patchstack

GHSA-3pxr-wpfc-92h9

PHP Deserialization Thrive Quiz Builder

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:44 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

Articles & Coverage 2

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026 News Critical PHP Object Injection in Thrive Quiz Builder WordPress Plugin - CVE-2026-59544 Jul 23, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the Thrive Quiz Builder WordPress plugin (versions 10.9.3.0 and earlier) lets remote attackers inject crafted serialized PHP objects that are deserialized by the plugin, enabling POP-chain abuse that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 with a fully network-reachable, no-privilege, no-interaction vector, making any unpatched site running the plugin a high-value target. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all WordPress instances to identify whether Thrive Quiz Builder plugin version 10.9.3.0 or earlier is installed and immediately disable the plugin on affected sites to eliminate the attack surface. …

Threat intelligence, references, and detailed analysis are available after sign-in.