---
id: "CVE-2026-87112"
page: "https://infrastack.ai/live/CVE-2026-87112"
kind: "vulnerability"
aliases: ["CVE-2026-87112"]
title: "WordPress QA Assistants plugin: unauthenticated object injection leads to code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "qa-heatmap-analytics", "fixed": ["5.3.0.1"], "affected": "<= 5.3.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["patched-5.3.0.1+", "plugin-not-installed"]
published_at: "2026-11-07T07:17:05+00:00"
first_seen_at: "2026-11-07T07:46:07+00:00"
updated_at: "2026-11-07T07:48:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87112", "first_seen_at": "2026-11-07T07:46:07+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/qa-heatmap-analytics/qa-assistants-530-unauthenticated-php-object-injection-to-remote-code-execution-via-raw-name-and-dlevent-ver-parameters", "first_seen_at": "2026-11-07T07:48:33+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/qa-heatmap-analytics/qa-assistants-530-unauthenticated-php-object-injection-to-remote-code-execution-via-raw-name-and-dlevent-ver-parameters", "https://patchstack.com/database/wordpress/plugin/qa-heatmap-analytics/vulnerability/wordpress-qa-assistants-driven-by-data-plugin-5-3-0-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability", "https://wordpress.org/plugins/qa-heatmap-analytics/"]}]
exploit_sources: []
---

# WordPress QA Assistants plugin: unauthenticated object injection leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-87112 (this .md is for agents)

The QA Assistants plugin for WordPress unserializes attacker-supplied data through the dlevent_ver parameter without restriction, letting an unauthenticated attacker inject a PHP object. A Guzzle gadget in the bundled dependencies can then write attacker-chosen files, which can lead to remote code execution on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:qa-heatmap-analytics affected <= 5.3.0 fixed 5.3.0.1

## How to check

- In WordPress admin, Plugins > Installed Plugins: look for 'QA Assistants – Driven by data' (slug qa-heatmap-analytics). Version 5.3.0 or earlier is vulnerable (the plugin header or wp plugin get qa-heatmap-analytics --field=version shows it).
- 5.3.0.1 is the fixed version; 5.3.0.2 is current.
- Also check the web root for unexpected PHP files written under the plugin's data directories, and look for requests to wp-cron.php with odd parameters.

## Fix

Update QA Assistants – Driven by data (slug qa-heatmap-analytics) to 5.3.0.1 or later; 5.3.0.2 is current and fixes a separate XSS.

## Timeline

- 2026-11-07T07:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87112
- 2026-11-07T07:48:33+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/qa-heatmap-analytics/qa-assistants-530-unauthenticated-php-object-injection-to-remote-code-execution-via-raw-name-and-dlevent-ver-parameters — Wordfence and Patchstack (both third-party) give fixed version 5.3.0.1; the wordpress.org changelog (maintainer QuarkA) lists 5.3.0.1 as 'Security and internal improvements' without naming the CVE, and 5.3.0.2 is the latest (a further security fix). Nothing marked verified because no maintainer page names this CVE. No exploitation or PoC found; Patchstack expects mass exploitation. Wordfence vector says PR:L although the text says unauthenticated. X not checked.

## Documents

- [advisory] Wordfence: QA Assistants <= 5.3.0 unauthenticated PHP object injection to RCE https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/qa-heatmap-analytics/qa-assistants-530-unauthenticated-php-object-injection-to-remote-code-execution-via-raw-name-and-dlevent-ver-parameters
- [advisory] Patchstack: QA Assistants <= 5.3.0 deserialization https://patchstack.com/database/wordpress/plugin/qa-heatmap-analytics/vulnerability/wordpress-qa-assistants-driven-by-data-plugin-5-3-0-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability
- [fix] QA Assistants – Driven by data (wordpress.org, changelog) https://wordpress.org/plugins/qa-heatmap-analytics/

## From the sources

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled content to an attacker-chosen filename, which can result in Remote Code Execution. Exploitation requires triggering the qahm_cron_data_manage scheduled event via wp-cron.php to invoke the deserialization sink against a planted queue file, but this endpoint requires no authentication and fires automatically on a two-minute schedule.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_