WordPress Plugin Vulnerabilities

QA Assistants – Driven by data < 5.2.0.1 - Unauthenticated Remote Code Execution

Description

The QA Assistants – Driven by data plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.2.0.0. This makes it possible for unauthenticated attackers to execute code on the server.

Affects Plugins

Plugin icon
qa-heatmap-analytics
Fixed in 5.2.0.1

References

CVE
CVE-2026-27544
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2553c88-3bef-4a9f-8339-f6667aa5fb93

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
K. Sorrachat
Verified
No
WPVDB ID
6add78c5-59d6-463d-837e-eaa05e8b606b

Timeline

Publicly Published
2026-08-11 (about 1 month ago)
Added
2026-08-14 (about 1 month ago)
Last Updated
2026-08-14 (about 1 month ago)

Other

Published
Title
Published
2023-10-12
Title
Nexter Extension < 2.0.4 - Authenticated(Editor+) Remote Code Execution via metabox
Published
2026-08-25
Title
Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
Published
2026-03-02
Title
Master Addons for Elementor Premium < 2.1.4 - Authenticated (Subscriber+) Remote Code Execution via render_preview
Published
2024-04-24
Title
FOX – Currency Switcher Professional for WooCommerce < 1.4.1.9 - Unauthenticated Arbitrary Shortcode Execution
Published
2026-07-02
Title
CURCY < 2.2.15 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter