{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/expresstech/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-111408"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Quiz And Survey Master (\u003c= 11.2.7)"],"_cs_severities":["high"],"_cs_tags":["wordpress","deserialization","cve"],"_cs_type":"advisory","_cs_vendors":["ExpressTech"],"content_html":"\u003cp\u003eThe Quiz And Survey Master plugin for WordPress, developed by ExpressTech, contains a deserialization of untrusted data vulnerability identified as CVE-2026-111408. This vulnerability affects all versions of the plugin up to and including 11.2.7. The flaw resides in how the plugin handles serialized data, allowing an attacker to perform object injection attacks. By providing a specially crafted serialized payload to the affected application component, an unauthenticated or authenticated attacker can manipulate application objects, which may result in arbitrary code execution, privilege escalation, or other unauthorized operations within the web server environment. This vulnerability is particularly critical due to the potential for remote code execution (RCE) in a WordPress environment, where plugin-level compromises can lead to full site takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to inject malicious objects, potentially leading to arbitrary code execution. This impacts any WordPress site running the Quiz And Survey Master plugin version 11.2.7 or earlier. If exploited, an attacker could gain complete control over the compromised WordPress instance, access the underlying database, exfiltrate sensitive site content, or use the server as a pivot point for further lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the ExpressTech Quiz And Survey Master plugin to the latest version, ensuring it is patched beyond version 11.2.7.\u003c/li\u003e\n\u003cli\u003eAudit WordPress site installations for the presence of the Quiz And Survey Master plugin.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to inspect HTTP requests for serialized PHP objects (e.g., strings containing \u0026quot;O:[0-9]+:\u0026quot;).\u003c/li\u003e\n\u003cli\u003eMonitor server logs for unexpected process execution triggered by the web server user (e.g., www-data).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T12:03:29Z","date_published":"2026-10-19T12:03:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111408/","summary":"A deserialization of untrusted data vulnerability in the Quiz And Survey Master WordPress plugin (CVE-2026-111408) allows for object injection, potentially leading to arbitrary code execution.","title":"Deserialization Vulnerability in ExpressTech Quiz And Survey Master","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111408/"}],"language":"en","title":"CraftedSignal Threat Feed - ExpressTech","version":"https://jsonfeed.org/version/1.1"}