The flaw is an unauthenticated PHP Object Injection in the Thrive Quiz Builder plugin for WordPress. When a crafted serialized object is sent to the plugin, it deserializes the data without sufficient validation, allowing an attacker to instantiate arbitrary PHP objects. This leads to remote code execution, potential data corruption, and unauthorized disclosure of information. The vulnerability is classified as CWE‑502, highlighting a lack of proper deserialization safeguards.

The plugin affected is Thrive Quiz Builder provided by Thrive Themes for WordPress, with vulnerabilities present in versions 10.9.3.0 and all earlier releases. Any WordPress site that has installed or upgraded to these or earlier versions is susceptible, whether the site is used for e‑learning, marketing, or other purposes.

Based on the description, the likely attack vector is network‑based; attackers can trigger the vulnerability via unauthenticated HTTP requests to the site. The CVSS score of 9.8 marks the vulnerability as critical, and the EPSS score of <1% indicates a low probability of immediate exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed yet. The scope extends from the application to the PHP interpreter, potentially compromising the entire server.