Deserialization of untrusted data in the ExpressTech Quiz And Survey Master plugin permits PHP Object Injection, which can enable an attacker to inject malicious objects into the application’s memory space. This weakness, classified as CWE-502, can lead to remote code execution, allowing an attacker to compromise the host server and potentially all data therein. The severity of this issue is reflected by a CVSS score of 8.8, highlighting its critical potential impact on confidentiality, integrity, and availability.

The vulnerability is present in all versions of the WordPress Quiz And Survey Master plugin up to and including 11.2.7. Users running any of these versions on their WordPress sites are affected. The affected product is the ExpressTech Quiz And Survey Master plugin, commonly installed as part of WordPress quiz and survey functionality.

The CVSS score of 8.8 indicates a high severity risk. No EPSS score is available, so the probability of exploitation is unknown at this time, but the lack of a CISA KEV listing does not diminish the urgency. Based on the description, the likely attack vector involves sending crafted input to the plugin’s deserialization endpoint; however, specific network requirements or prerequisites are not detailed in the provided data. The vulnerability likely requires an authenticated or privileged user to interact with the plugin, but this is inferred and not explicitly documented.