External risk intelligence

Thrive Quiz Builder Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-59544

The vulnerability exists in a WordPress plugin designed to create and manage public-facing quizzes. Such plugins are intentionally deployed to be reachable by internet users to facilitate user engagement, making the web-accessible interface a standard and primary component of its deployment.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Thrive Quiz Builder, a WordPress plugin used for creating quizzes. This issue, if exploited, could allow unauthenticated attackers to inject and execute arbitrary PHP code on affected systems, potentially leading to significant compromise. The main concern is to confirm if this plugin is in use and exposed to the internet.

Unauthenticated code injection in quiz software.
Potential for unauthorized system access.
Confirm use and internet exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to a website using the affected plugin. Because no authentication is required, an attacker can reach the vulnerable component directly over the network. Successful exploitation could lead to the injection and execution of arbitrary PHP code, potentially resulting in a complete compromise of the affected website.

No authentication needed.
Send malicious PHP object.
Full website compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact systems running the Thrive Quiz Builder plugin when unauthenticated users interact with it. Specifically, it may allow for the injection of malicious PHP objects, potentially affecting the behavior of the service and exposing sensitive information.

Service behavior and sensitive data.
Via unauthenticated interaction with the plugin.
Potential for system compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in Thrive Quiz Builder affects publicly accessible web applications. Owners of WordPress sites utilizing this plugin, along with their respective infrastructure or platform teams, are responsible for initial assessment. The immediate first step is to identify all instances of the affected plugin, confirm its external reachability and business criticality, and assign an accountable owner for remediation planning.

WordPress site owners and platform teams.
Verify plugin reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Thrive Quiz Builder?

Thrive Quiz Builder is a WordPress plugin designed for building and managing interactive quizzes. It is typically embedded into websites to increase visitor engagement by allowing users to complete assessments or surveys directly within their web browser.

How does this PHP Object Injection work in CVE-2026-59544?

The flaw falls under CWE-502, which concerns the deserialization of untrusted data. Because the plugin improperly handles serialized PHP objects, an attacker can supply malicious input that the application processes as legitimate code, potentially leading to unauthorized execution.

Do I need to be logged into the website for this to be triggered?

No. The vulnerability is unauthenticated, meaning an attacker does not need a user account or administrative privileges to trigger the flaw. Simply sending a specially crafted network request to the plugin's endpoint is sufficient to reach the vulnerable code path.

Is my site at higher risk if it uses Thrive Quiz Builder?

According to Halo Surface Signal, this plugin is intentionally designed to be reachable by internet users for quiz participation. Because the component is meant to be public-facing, it sits in a position where remote, network-based access is the standard, increasing the relevance of this issue for most installations.

What should I do first to manage this risk?

Begin by auditing your WordPress site to confirm whether Thrive Quiz Builder is installed and currently active. Once identified, evaluate the plugin's internet accessibility and determine its role in your business operations to prioritize the timing of your update or mitigation plans.

References

patchstack.com/database/wordpress/plugin/thrive-quiz-builder/vulnera…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.