Quiz And Survey Master: PHP Object Injection via untrusted data deserialization
Summary
The WordPress plugin Quiz And Survey Master (quiz-master-next) up to and including version 11.2.7 deserializes untrusted data, which allows PHP Object Injection (CWE-502). According to the CVE record and Patchstack, an attacker with a low-privilege account (Contributor level) can send crafted input to create PHP objects on the server, which may lead to high impact on confidentiality, integrity and availability. CISA SSVC lists exploitation as none and the issue as not automatable.
Affected
- Quiz And Survey Master (WordPress plugin, package quiz-master-next) from n/a through 11.2.7
- Required privilege: Contributor (per Patchstack)
Fixed in
- Version 11.2.8 or later
Workaround
- Unknown. No workaround is documented in the sources. Patchstack may offer a virtual patch; check the Patchstack entry.
Exploitation
- No public exploit known; VulDB reports exploit not publicly available.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Patchstack rates the issue as medium priority and expects exploitation.
Our recommendation
- Check whether Quiz And Survey Master (quiz-master-next) is installed and which version is in use.
- Update to version 11.2.8 or later.
- Review user roles and remove unused Contributor or Author accounts.
- Monitor the Patchstack entry for virtual patch or further version information.
- CVE-2026-104392 appears to cover the same plugin flaw; confirm whether the two IDs are duplicates before closing tickets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-111408 patchstack.com
- OpenCVE CVE-2026-111408 app.opencve.io
- VulDB 422303 vuldb.com
- GitHub fix pull request 3278 github.com
- Vulners CVE-2026-104392 (possible duplicate) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:53.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.