{
 "id": "WPSEC-2026-2954",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2954/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2954/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2954/index.md",
 "title": "QA Assistants <= 5.3.0.2 - Unauthenticated Remote Code Execution via Replay and Heatmap Capture Files",
 "description": "The QA Assistants plugin for WordPress is vulnerable to Remote Code Execution via replay and heatmap capture files in all versions up to, and including, 5.3.0.2. This is due to the plugin saving remotely fetched HTML, together with the unescaped page URL, into '-cap.php' files in its web-accessible data directory, which run as PHP when loaded. The page URL, and therefore the fetched content, can be supplied by unauthenticated visitors through the public tracking endpoint. This makes it possible for unauthenticated attackers to have arbitrary PHP code written to the server and executed once an administrator opens the replay or heatmap for the planted page.",
 "plugin": {
  "slug": "qa-heatmap-analytics",
  "name": "QA Assistants",
  "full_name": "QA Assistants – Driven by data",
  "wordpress_org": "https://wordpress.org/plugins/qa-heatmap-analytics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/qa-heatmap-analytics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.0.3",
 "remediation": "Update to 5.3.0.3 or later.",
 "fix_released": "2026-11-10T02:52:07+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:36.371374+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2954/",
  "https://plugins.svn.wordpress.org/qa-heatmap-analytics/tags/5.3.0.3/",
  "https://wordpress.org/plugins/qa-heatmap-analytics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}