CVE-2026-104392: WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability has a privileges-required rating of low, so exploitation requires an attacker to have some level of authenticated access. No user interaction is required.

Q: Can this be exploited remotely, and what is the potential impact?

Yes. The attack vector is network-based with low attack complexity. Successful exploitation may result in high impacts to confidentiality, integrity, and availability.

Q: Which versions are affected?

Quiz And Survey Master versions through 11.2.7 are affected. The provided data does not identify a fixed version.

Published Oct 9, 2026

Updated

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

Affected Software

1 affected component

ExpressTech Quiz And Survey Master<=11.2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Quiz And Survey Master plugin to a version that resolves this vulnerability.
Fixed in 11.2.8

Event History

Oct 9, 2026

CVE Published

via MITRE·12:08 PM

Data Sourced

via MITRE·12:08 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability has a privileges-required rating of low, so exploitation requires an attacker to have some level of authenticated access. No user interaction is required.

Can this be exploited remotely, and what is the potential impact?