CVE-2026-59544
This vulnerability allows attackers to inject PHP objects into Thrive Quiz Builder versions 10.9.3.0 and earlier. It can be exploited without authentication and can lead to full compromise of the affected site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Thrive Quiz Builder plugin for WordPress, versions 10.9.3.0 and earlier.
Real-world impact
An attacker could execute arbitrary code on the server, steal data, or take control of the website.
Why this severity
The CVSS score of 9.8 reflects the lack of authentication required, the high impact on confidentiality, integrity, and availability, and the low effort needed to exploit.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources