The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 5.3.0. An attacker can send crafted input using the raw_name and dlevent_ver parameters to trigger unserialize() without class restrictions on the deserialized payload. The deserialization gadget chain can leverage the bundled Guzzle FileCookieJar class, enabling an arbitrary file write of attacker‑controlled content. Writing executable code to the web root or other writable locations allows complete remote code execution. The vulnerability is exploitable without authentication by triggering the wp‑cron scheduled event via wp-cron.php, which runs automatically every two minutes.

Any WordPress site using the QA Assistants plugin version 5.3.0 or earlier. The vendor is Quarka and the product is referred to as QA Assistants – Driven by data. Specific affected versions are all releases up to 5.3.0; no newer fixed version is listed in the provided data.

The CVSS score of 8.8 classifies this issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet reported. The likely attack vector is unauthenticated remote exploitation via the automatic wp-cron process. An attacker who can force wp-cron to run (which it does automatically) can supply malicious parameters and achieve remote code execution by manipulating the plugin’s deserialization workflow and the Guzzle gadget. Because no authentication is required and the triggering endpoint is publicly accessible, the threat is significant even in environments with limited user accounts.