blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-87112

HIGH 8.8 CVSS 3.1
Published
November 7, 2026
Last modified
November 8, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-502
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled content to an attacker-chosen filename, which can result in Remote Code Execution. Exploitation requires triggering the qahm_cron_data_manage scheduled event via wp-cron.php to invoke the deserialization sink against a planted queue file, but this endpoint requires no authentication and fires automatically on a two-minute schedule.

Affected WordPress components

  • QA Assistants – Driven by data Plugin · qa-heatmap-analytics
    Confirmed match Active
    Up to and including 5.3.0
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • quarka QA Assistants – Driven by data — Up to and including 5.3.0

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/class-qahm-admin-page-realtime.php#L183
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/class-qahm-base.php#L701
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/class-qahm-behavioral-data.php#L770
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/class-qahm-core-base.php#L780
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/class-qahm-cron-proc.php#L698
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/qahm-ajax.php#L319
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/tags/5.2.0.1/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L38
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?reponame=&old=3728466%40qa-heatmap-analytics&new=3728466%40qa-heatmap-analytics
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/76c5b5f1-a04b-4219-b8c0-ee53139fa787?source=cve
  • nvd.nist.gov Official NVD record