CVE-2026-87112

Summary

The QA Assistants – Driven by data WordPress plugin (<=5.3.0) contains a PHP Object Injection vulnerability due to unsafe deserialization via wrap_unserialize_static() and insufficient sanitization in serialize_escape(), allowing unauthenticated attackers to inject malicious PHP objects. Attackers can leverage the bundled Guzzle FileCookieJar gadget to write arbitrary files, potentially achieving Remote Code Execution.

Exploitability

Exploitation requires no authentication and is triggered automatically via the wp-cron.php endpoint every two minutes after an attacker plants a crafted queue file, making it highly exploitable once the initial payload is delivered.

Blast radius

Successful exploitation could lead to full server compromise via arbitrary file write (e.g., webshell deployment), enabling complete data breach, system takeover, or lateral movement within the hosting environment.

Detection

Defenders should monitor wp-content/uploads/ for unexpected or recently modified files with non-standard extensions (e.g., .php, .inc) in directories accessible via the web, and inspect wp_options table entries related to cron events for anomalies in scheduled task payloads; additionally, logs at wp-content/debug.log may contain PHP warnings or errors during deserialization attempts if WP_DEBUG is enabled.

Prioritized remediation

Upgrade to version 5.3.1 or later, which addresses the deserialization vulnerability by applying allowed_classes restrictions and sanitizing raw_name path traversal sequences.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.