Key points
- The flaw is CVE-2026-111408, rated high severity with a CVSS score of 8.8.
- It allows object injection through the deserialisation of untrusted data.
- All versions of Quiz And Survey Master up to and including 11.2.7 are affected.
A high-severity vulnerability in the ExpressTech Quiz And Survey Master plugin exposes organisations to object injection risks. The flaw, tracked as CVE-2026-111408, affects versions up to 11.2.7 and currently has no confirmed patch available for deployment.
What happened
The US National Vulnerabilities Database records CVE-2026-111408 as a high-severity issue with a CVSS score of 8.8. The weakness is classified under CWE-502, which covers the deserialisation of untrusted data. This specific flaw permits object injection within the plugin’s processing logic. The issue exists in Quiz And Survey Master versions ranging from the earliest releases through version 11.2.7. ExpressTech is the vendor responsible for the software.
Why it matters
Object injection vulnerabilities allow attackers to manipulate the data structures an application uses during runtime. In this case, the plugin processes untrusted data without adequate validation before deserialisation. This mechanism can lead to unexpected behaviour or compromise of the hosting environment. Security teams must treat any instance of this plugin as a potential entry point for malicious activity. The high CVSS score reflects the significant impact such an injection can have on system integrity.
What happens next
Organisations should immediately audit their environments for installations of Quiz And Survey Master. Identify all systems running versions up to 11.2.7. Check whether the plugin is actively serving external users or processing public submissions. If the plugin is not essential, consider disabling it to reduce the attack surface. Monitor vendor communications closely for the release of a patched version. Prepare internal update procedures to deploy the fix as soon as it becomes available.
Patch priority
Teams usually prioritise systems that expose this plugin to external internet traffic over internal-only deployments. Check whether the quiz functionality accepts submissions from unauthenticated users, as this increases exposure risk. Test any available updates in a staging environment before rolling them out to production servers. Back up current configurations and databases prior to applying changes to ensure rollback capability if issues arise. Reduce exposure by restricting access to the plugin’s endpoints while awaiting a permanent fix from the vendor.
What to do and how to stay safe: ExpressTech
- Verify all installations of Quiz And Survey Master are on versions lower than 11.2.7 to confirm exposure.
- Restrict network access to the plugin’s submission endpoints to prevent unauthorised data injection attempts.
- Monitor server logs for unusual deserialisation errors or unexpected object instantiation patterns.
- Await official guidance from ExpressTech before deploying any unverified workarounds or patches.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Quiz And Survey Master are affected by CVE-2026-111408?
All versions from the initial release through version 11.2.7 are affected by this vulnerability.
Is there a patch available for this vulnerability?
No fix has been confirmed yet, so teams must rely on mitigation strategies until an update is released.
What type of vulnerability is CVE-2026-111408?
It is an object injection flaw caused by the deserialisation of untrusted data, rated high severity.
