CVE-2026-87112: QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or other authentication is required. The vulnerable deserialization path is reached through wp-cron.php when the qahm_cron_data_manage event processes an attacker-planted queue file.

Q: Is administrator interaction or a manually triggered job required?

No. The relevant wp-cron.php endpoint does not require authentication, and the scheduled event fires automatically every two minutes. An attacker can also trigger the event through wp-cron.php to invoke the deserialization sink.

Q: What is the practical impact of successful exploitation?

The bundled Guzzle FileCookieJar gadget can be used to write attacker-controlled content to an attacker-chosen file path. This arbitrary file write can lead to remote code execution.

Q: Which inputs are involved in the exploit chain?

The dlevent_ver parameter reaches unrestricted PHP deserialization through wrap_unserialize_static() and unserialize(). The raw_name parameter is involved because serialize_escape() does not sanitize path traversal sequences, enabling placement of the queue file processed by the scheduled event.

Published Nov 7, 2026

Updated

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dleventver' parameter. This is due to unrestricted PHP deserialization via wrapunserializestatic() calling unserialize() without an allowedclasses restriction, combined with serializeescape() failing to sanitize path traversal sequences in the rawname parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled content to an attacker-chosen filename, which can result in Remote Code Execution. Exploitation requires triggering the qahmcrondatamanage scheduled event via wp-cron.php to invoke the deserialization sink against a planted queue file, but this endpoint requires no authentication and fires automatically on a two-minute schedule.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:39 AM

Data Sourced

via MITRE·06:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it; no WordPress account or other authentication is required. The vulnerable deserialization path is reached through wp-cron.php when the qahm_cron_data_manage event processes an attacker-planted queue file.

Is administrator interaction or a manually triggered job required?

No. The relevant wp-cron.php endpoint does not require authentication, and the scheduled event fires automatically every two minutes. An attacker can also trigger the event through wp-cron.php to invoke the deserialization sink.

What is the practical impact of successful exploitation?

The bundled Guzzle FileCookieJar gadget can be used to write attacker-controlled content to an attacker-chosen file path. This arbitrary file write can lead to remote code execution.

Which inputs are involved in the exploit chain?

The dlevent_ver parameter reaches unrestricted PHP deserialization through wrap_unserialize_static() and unserialize(). The raw_name parameter is involved because serialize_escape() does not sanitize path traversal sequences, enabling placement of the queue file processed by the scheduled event.

CVE-2026-87112: QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

Event History

Frequently Asked Questions

Who can exploit this issue?

Is administrator interaction or a manually triggered job required?

What is the practical impact of successful exploitation?

Which inputs are involved in the exploit chain?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is administrator interaction or a manually triggered job required?

What is the practical impact of successful exploitation?

Which inputs are involved in the exploit chain?