Description
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Published: 2026-10-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Object Injection leading to potential Remote Code Execution
Action: Patch Now
AI Analysis

Impact

The vulnerability arises from deserialization of untrusted data within the ExpressTech Quiz And Survey Master plugin, allowing an attacker to perform PHP Object Injection. By supplying crafted serialized input, an adversary can instantiate arbitrary PHP objects, potentially leading to remote code execution or other destructive actions. This weakness is classified as CWE-502.

Affected Systems

The affected product is the ExpressTech Quiz And Survey Master WordPress plugin, any installation of versions 11.2.7 and earlier. The vulnerability exists in all releases prior to 11.2.8.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that exploitation requires an attacker to supply crafted HTTP requests that the plugin processes, triggering object injection.

Generated by OpenCVE AI on October 9, 2026 at 13:52 UTC.

Remediation

Vendor Solution

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 11.2.8).

OpenCVE Recommended Actions

  • Update the plugin to version 11.2.8 or later.
  • Disable or uninstall the plugin if an immediate update is not possible.
  • Validate and sanitize all user‑supplied inputs to prevent deserialization of untrusted data.

Generated by OpenCVE AI on October 9, 2026 at 13:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 10 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Title WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-09T20:01:16.901Z

Reserved: 2026-10-02T00:22:13.105Z

Link: CVE-2026-104392

cve-icon Vulnrichment

Updated: 2026-10-09T20:01:12.608Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T13:17:08.227

Modified: 2026-10-09T21:17:02.470

Link: CVE-2026-104392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T14:00:07Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data