The SS Quiz plugin for WordPress contains a deserialization flaw that permits PHP object injection. An attacker who can supply a crafted serialized payload can execute arbitrary code on the server, leading to full compromise of the hosting environment. This is a classic CWE‑502 type weakness that may allow remote code execution, credential theft, or defacement of the WordPress site.

All installations of the ssvadim SS Quiz plugin (ssquiz) running any version from the initial release up to and including 2.0.5 are affected. WordPress sites that have that plugin installed and have not applied an update are exposed to this vulnerability.

The CVSS score of 9.8 marks this flaw as critical. Although the EPSS value is less than 1%, indicating a very low probability of widespread automated exploitation, the absence of reported exploits in CISA’s KEV catalog suggests it has not yet been actively leveraged. The likely attack vector involves an attacker sending a crafted HTTP request containing a serialized PHP object to the plugin’s deserialization point—a vector that is presumed possible if the plugin exposes such an endpoint. Prompt remediation is essential because once the object is injected, an attacker can potentially run arbitrary PHP code, fully compromising the site and its underlying server.