EUVD-2026-104133
GHSA-rm2p-p3w4-ccqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
DeliverySubmit crafted serialized payload to plugin endpoint
-
ExploitTrigger PHP object instantiation via unserialize()
-
ExecutionExecute POP gadget chain
-
ImpactAchieve code execution or data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target WordPress site - the CVSS vector specifies PR:L, so at minimum a low-privilege registered user (e.g., subscriber) is needed; it is not exploitable by fully anonymous attackers. The target must run the Quiz And Survey Master plugin at version 11.2.7 or earlier. The attacker must be able to reach a plugin feature that passes attacker-supplied data into PHP unserialization (CWE-502 Object Injection); successful code execution additionally depends on a suitable POP gadget chain being present in the plugin, WordPress core, or other installed plugins/themes. No user interaction is required (UI:N), and no non-default configuration is indicated in the description - the limiting factors are the authentication requirement and the presence of an exploitable gadget chain. |
| Impact | This is a genuine high-priority vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with the CWE-502 PHP Object Injection/deserialization class, which commonly yields remote code execution via POP gadget chains. No EPSS score was supplied, and the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation at this time. The main risk signals (authenticated object injection in a widely-installed WordPress plugin) point to realistic exploitability once an attacker holds any low-privilege account, but the PR:L requirement and absence of KEV/POC data mean this is a serious patch-soon issue rather than a confirmed mass-exploited emergency. Note: EPSS and SSVC data were not provided in the input, so exploitation-probability and automatability cannot be assessed from available data. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege authenticated account (e.g., subscriber or any registered user) on a WordPress site running Quiz And Survey Master ≤ 11.2.7 submits a crafted serialized PHP payload to a vulnerable plugin endpoint. When the plugin deserializes the untrusted input, attacker-controlled PHP objects are instantiated, triggering a POP gadget chain that can lead to remote code execution or data compromise. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
PHP object injection in the WordPress plugin Quiz And Survey Master (quiz-master-next) through version 11.2.7 allows an authenticated low-privilege user, such as a subscriber-level account, to pass attacker-controlled data into an unsafe unserialize() call and inject arbitrary PHP objects, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:L, the flaw is not reachable by fully anonymous visitors, but any site that allows open user registration effectively lowers the bar to a self-service account. Successful escalation to code execution or data tampering depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin or theme; no public exploit code or confirmed active exploitation was identified at time of analysis, and the plugin is widely deployed across WordPress sites, making it an attractive target for follow-on research.
RemediationAI
No vendor-released patch version was identified in the supplied data, so treat this as unpatched at time of analysis: check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-7-php-object-injection-vulnerability-2) and the WordPress.org plugin page, then upgrade quiz-master-next the moment a release above 11.2.7 is published, testing the fix on staging first since quiz and survey data schemas have historically changed between minor versions. Until then, the highest-value compensating control is to remove the low-privilege foothold the exploit depends on: disable open registration and demote or delete unused subscriber accounts, accepting the trade-off that legitimate community sign-ups must go through a manual approval flow; alternatively deactivate and remove the plugin if quizzes are not business-critical, which eliminates the attack surface entirely at the cost of losing existing survey functionality. Restrict access to plugin AJAX and REST endpoints (for example block unauthenticated or subscriber-role requests to admin-ajax.php actions and /wp-json/quiz-master-next/ paths at the reverse proxy) - effective but fragile because endpoint names change between releases and legitimate front-end quiz submissions may break. Deploy a virtual patch or WAF rule that flags serialized object payloads (O:\d+: or a:\d+:{ patterns) in plugin request parameters, understanding that encoding tricks can bypass signature-based rules, and confirm that display_errors and debug output do not leak gadget class paths that help attackers build a chain. Finally, inventory other installed plugins and themes for known POP chains, since removing gadget-bearing extensions lowers the chance that any residual injection primitive reaches code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502, Deserialization of Untrusted Data, a class of bug specific to languages with object serialization such as PHP. The plugin accepts data from a request or stored record and hands it to PHP's unserialize() (or an equivalent like maybe_unserialize() in WordPress) without restricting allowed classes. PHP's unserialize() instantiates whatever classes are named in the payload and automatically invokes magic methods such as __wakeup() and __destruct(), so a crafted serialized string can drive a property-oriented programming (POP) chain that ends in dangerous sinks - file writes, call_user_func(), SQL, or arbitrary object deletion. Exploitation is therefore two-stage: the injection primitive is in the plugin, but the impact ceiling is set by which gadget classes are autoloadable on the target. The CPE cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:*:*:* identifies the ExpressTech WordPress plugin, and the affected range extends through 11.2.7. The network vector and low attack complexity explain the 8.8 score, while the PR:L requirement reflects that the vulnerable sink sits behind a capability or form path that a logged-in user can reach.
Know when Quiz And Survey Master gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable plugin endpoint (AV:N), no user interaction (UI:N), but PHP object injection requires a valid low-privilege account (PR:L); deserialization-to-RCE justifies full C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Articles & Coverage 1
Executive ViewAI
Quiz And Survey Master (quiz-master-next) through version 11.2.7 carries a high-severity object-injection weakness that a low-privilege authenticated user, including a self-registered subscriber on sites with open registration, could use to attempt data tampering or code execution if a suitable gadget chain exists elsewhere in the WordPress stack. Because no vendor-released patch is available and the plugin is widely deployed, leadership should prioritize sites with open registration or untrusted subscriber populations and reduce account-creation and plugin risk while monitoring for suspicious activity.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing Quiz And Survey Master through 11.2.7 where not essential, restricting or disabling open registration and subscriber self-provisioning, reviewing and removing unnecessary low-privilege accounts, reducing installed plugins and themes to limit gadget chains, deploying WAF or virtual patching, and monitoring for anomalous plugin or account activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Quiz And Survey Master
View allThe Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_i
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the r
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. Rated
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL I
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz s
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Rated critical severity (CVSS 9.8), this v
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields befo
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, w
Exploit-DB