QA Assistants <= 5.3.0.2 - Unauthenticated Remote Code Execution via Replay and Heatmap Capture Files
- ID
- WPSEC-2026-2954
- Plugin
- QA Assistants – Driven by data (qa-heatmap-analytics)
- Affected
- all versions before 5.3.0.3
- Remediation
- Update to 5.3.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- QA Assistants on WPSec AttackSurface
- Fix released
- Published
Description
The QA Assistants plugin for WordPress is vulnerable to Remote Code Execution via replay and heatmap capture files in all versions up to, and including, 5.3.0.2. This is due to the plugin saving remotely fetched HTML, together with the unescaped page URL, into '-cap.php' files in its web-accessible data directory, which run as PHP when loaded. The page URL, and therefore the fetched content, can be supplied by unauthenticated visitors through the public tracking endpoint. This makes it possible for unauthenticated attackers to have arbitrary PHP code written to the server and executed once an administrator opens the replay or heatmap for the planted page.
References
- https://wpsec.com/vuln/WPSEC-2026-2954/
- https://plugins.svn.wordpress.org/qa-heatmap-analytics/tags/5.3.0.3/
- https://wordpress.org/plugins/qa-heatmap-analytics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS