{"id":"CVE-2026-104392","published":"2026-10-09T13:17:08.227","lastModified":"2026-10-09T21:17:02.470","description":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-7-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious objects during deserialization, potentially leading to remote code execution or data manipulation in the Quiz And Survey Master plugin. The flaw occurs when untrusted data is processed during object deserialization.","exploitability":"Exploitation requires a low-privilege user account and is moderately difficult to achieve, needing specific conditions like sending crafted serialized data through API endpoints that process quiz/survey submissions.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the target system, potentially leading to full compromise of the WordPress site and access to sensitive user data or survey responses.","remediation":"Upgrade to version 11.2.8 or later to remediate this deserialization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","wordpress","rce"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:51:04.527Z"}}