# QA Assistants <= 5.3.0.2 - Unauthenticated Remote Code Execution via Replay and Heatmap Capture Files

- **ID:** WPSEC-2026-2954
- **Plugin:** QA Assistants – Driven by data (`qa-heatmap-analytics`), https://wordpress.org/plugins/qa-heatmap-analytics/
- **Affected versions:** all versions before 5.3.0.3
- **Fixed in:** 5.3.0.3 (Update to 5.3.0.3 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2954/

## Description

The QA Assistants plugin for WordPress is vulnerable to Remote Code Execution via replay and heatmap capture files in all versions up to, and including, 5.3.0.2. This is due to the plugin saving remotely fetched HTML, together with the unescaped page URL, into '-cap.php' files in its web-accessible data directory, which run as PHP when loaded. The page URL, and therefore the fetched content, can be supplied by unauthenticated visitors through the public tracking endpoint. This makes it possible for unauthenticated attackers to have arbitrary PHP code written to the server and executed once an administrator opens the replay or heatmap for the planted page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2954/
- https://plugins.svn.wordpress.org/qa-heatmap-analytics/tags/5.3.0.3/
- https://wordpress.org/plugins/qa-heatmap-analytics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2954/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.