PHP Object Injection Vulnerability in QA Assistants Plugin for WordPress

CVE-2026-87112

What is CVE-2026-87112?

The QA Assistants plugin for WordPress is susceptible to PHP Object Injection through the 'dlevent_ver' parameter. This vulnerability arises from unrestricted PHP deserialization, facilitated by the wrap_unserialize_static() function, which calls unserialize() without restrictions on allowed classes. Additionally, the serialize_escape() function does not adequately sanitize path traversal sequences in the raw_name parameter. As a result, unauthenticated attackers can inject PHP Objects, potentially leading to arbitrary file writing through the Guzzle FileCookieJar component in the plugin's dependencies, thereby enabling Remote Code Execution. Exploitation requires triggering the scheduled qahm_cron_data_manage event via wp-cron.php, which executes without authentication every two minutes, posing a significant risk to affected sites.

References