{"id":"CVE-2026-111408","kind":"vulnerability","aliases":["CVE-2026-111408"],"related":[],"title":"Quiz And Survey Master WordPress plugin: object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","summary":"The quiz-master-next WordPress plugin by ExpressTech deserializes untrusted data, which allows PHP object injection. Per the sources, an attacker could potentially reach code execution or take over the site, but the exact gadget chain is not described.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","quiz-master-next","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-above-11.2.7"],"how_to_check":"Check the installed plugin version in the WordPress admin plugins list or wp-content/plugins/quiz-master-next; versions through 11.2.7 are affected.","fix":"Update Quiz And Survey Master (quiz-master-next) to a version later than 11.2.7; the patched version number is unknown from the sources.","status":"open","published_at":"2026-10-19T10:16:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:33:13+00:00","updated_at":"2026-10-23T22:33:13+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T22:33:13Z","model":"claude-haiku-5-5","output":{"fix":"Update Quiz And Survey Master (quiz-master-next) to a version later than 11.2.7; the patched version number is unknown from the sources.","reach":"internet","title":"Quiz And Survey Master WordPress plugin: object injection lets attackers run code","impact":"high","summary":"The quiz-master-next WordPress plugin by ExpressTech deserializes untrusted data, which allows PHP object injection. Per the sources, an attacker could potentially reach code execution or take over the site, but the exact gadget chain is not described.","category":"package","who_cares":["wordpress","quiz-master-next","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may run code on the WordPress server via object injection.","analyst_note":"Confirm the patched version and whether unauthenticated access is needed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111408 and the plugin's changelog.","how_to_check":"Check the installed plugin version in the WordPress admin plugins list or wp-content/plugins/quiz-master-next; versions through 11.2.7 are affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-11.2.7"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000528,"input_tokens":2898,"output_tokens":477,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111408':15A,18A '-2026':14A,17A '11.2.7':95C 'affect':87C 'allow':41B,83C 'attack':10A,49B 'chain':64B 'code':12A,53B 'could':50B 'cve':13A,16A 'data':39B,71C 'describ':67B 'deseri':37B,68C 'exact':62B 'execut':54B 'expresstech':36B,74C 'gadget':63B 'host':26B 'inject':8A,44B 'injection.this':85C 'issu':86C 'let':9A 'master':4A,22B,31B,78C,81C,91C 'n/a':93C 'next':23B,32B,82C 'object':7A,43B,84C 'packag':19B 'per':45B 'php':42B 'plugin':6A,34B 'potenti':51B 'quiz':1A,21B,30B,75C,80C,88C 'quiz-master-next':20B,29B,79C 'reach':52B 'run':11A 'self':25B 'self-host':24B 'site':59B 'sourc':47B 'survey':3A,77C,90C 'take':56B 'untrust':38B,70C 'vulner':72C 'wordpress':5A,27B,33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111408","severity":null,"published_at":"2026-10-19T10:16:46+00:00","modified_at":"2026-10-19T18:16:59+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}