CVE-2026-104392

Summary

This vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or data manipulation in the Quiz And Survey Master plugin. The flaw occurs when untrusted data is processed during object deserialization.

Exploitability

Exploitation requires a low-privilege user account and is moderately difficult to achieve, needing specific conditions like sending crafted serialized data through API endpoints that process quiz/survey submissions.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the target system, potentially leading to full compromise of the WordPress site and access to sensitive user data or survey responses.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 11.2.8 or later to remediate this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.