Quiz and Survey Master (<= 11.2.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/quiz-and-survey-master--11.2.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 12:03:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDeserialization Vulnerability in ExpressTech Quiz And Survey Masterhttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-111408/Mon, 19 Oct 2026 12:03:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-111408/A deserialization of untrusted data vulnerability in the Quiz And Survey Master WordPress plugin (CVE-2026-111408) allows for object injection, potentially leading to arbitrary code execution.The Quiz And Survey Master plugin for WordPress, developed by ExpressTech, contains a deserialization of untrusted data vulnerability identified as CVE-2026-111408. This vulnerability affects all versions of the plugin up to and including 11.2.7. The flaw resides in how the plugin handles serialized data, allowing an attacker to perform object injection attacks. By providing a specially crafted serialized payload to the affected application component, an unauthenticated or authenticated attacker can manipulate application objects, which may result in arbitrary code execution, privilege escalation, or other unauthorized operations within the web server environment. This vulnerability is particularly critical due to the potential for remote code execution (RCE) in a WordPress environment, where plugin-level compromises can lead to full site takeover.

Impact

Successful exploitation allows attackers to inject malicious objects, potentially leading to arbitrary code execution. This impacts any WordPress site running the Quiz And Survey Master plugin version 11.2.7 or earlier. If exploited, an attacker could gain complete control over the compromised WordPress instance, access the underlying database, exfiltrate sensitive site content, or use the server as a pivot point for further lateral movement within the network.

Recommendation

Prioritized actions for security teams:

  • Update the ExpressTech Quiz And Survey Master plugin to the latest version, ensuring it is patched beyond version 11.2.7.
  • Audit WordPress site installations for the presence of the Quiz And Survey Master plugin.
  • Implement web application firewall (WAF) rules to inspect HTTP requests for serialized PHP objects (e.g., strings containing "O:[0-9]+:").
  • Monitor server logs for unexpected process execution triggered by the web server user (e.g., www-data).
]]>highadvisorywordpressdeserializationcve