What is the CVSS score of EUVD-2026-57939?

EUVD-2026-57939 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of QA Analytics are affected by EUVD-2026-57939?

The QA Analytics WordPress plugin (v5.2.0.0 and earlier) contains an unpatched critical vulnerability allowing unauthenticated remote code execution on affected servers.

How to fix or mitigate EUVD-2026-57939?

Within 24 hours, inventory all WordPress installations to identify those running QA Analytics plugin version 5.2.0.0 or earlier. Within 7 days, either disable and remove the plugin from production or deploy Web Application Firewall (WAF) rules to block exploitation attempts. Within 30 days, continuously monitor vendor security advisories for patch availability; apply the update immediately upon release.

QA Analytics EUVD-2026-57939

| CVE-2026-27544 CRITICAL

Code Injection (CWE-94)

2026-08-13 Patchstack

GHSA-fv8g-mjfh-5j9v

WordPress RCE Code Injection Qa Analytics Wordpress Plugin

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated code injection with no interaction gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact; code executes within the web app context so I assess S:U rather than the reported S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:02 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

AnalysisAI

Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.

Technical ContextAI

The affected component is the QA Heatmap Analytics plugin for WordPress, published under the 'quarka' vendor identifier (cpe:2.3:a:quarka:qa_analytics:*). The weakness is classified as CWE-94 (Improper Control of Generation of Code, i.e. code injection), meaning attacker-controlled input reaches a dynamic execution context - commonly a PHP eval/callback path, deserialization sink, or unsanitized inclusion - allowing the attacker's data to be interpreted as executable code within the PHP/WordPress runtime. Because WordPress plugins run with the privileges of the web server process, successful injection typically yields full application-level code execution and access to the WordPress database and filesystem.

RemediationAI

Update the QA Heatmap Analytics plugin to a version later than 5.2.0.0 as published on the Patchstack advisory and the WordPress plugin repository; an exact fixed version number is not provided in the available data, so confirm the patched release directly against the vendor/Patchstack listing (https://patchstack.com/database/wordpress/plugin/qa-heatmap-analytics/vulnerability/wordpress-qa-analytics-plugin-5-2-0-0-remote-code-execution-rce-vulnerability) before deploying. If an immediate update is not possible, deactivate and remove the plugin, which fully removes the exposure at the cost of losing heatmap analytics functionality; alternatively, place the site behind a WAF and block requests to the plugin's endpoints under wp-content/plugins/qa-heatmap-analytics/, accepting that WAF rules are a stopgap that may be bypassed. Given pre-auth RCE, prioritize patching or removal over virtual patching.