A critical unauthenticated PHP Object Injection vulnerability in Thrive Quiz Builder allows remote attackers to achieve full system compromise.

This vulnerability involves CWE-502, Deserialization of Untrusted Data. The application fails to properly validate serialized PHP objects, allowing an unauthenticated attacker to inject malicious objects that lead to remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete data exfiltration, site defacement, and the deployment of persistent backdoors within the hosting environment.

Immediate Action: Update the Thrive Quiz Builder plugin to version 10.9.3.1 or the latest available release immediately.

Proactive Monitoring: Review web server access logs for unusual POST requests containing serialized PHP strings or unexpected file modifications in the WordPress directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious serialized PHP payloads targeting plugin endpoints.

Public Exploit Available: Unknown

This vulnerability is classified as critical due to the potential for unauthenticated remote code execution. Administrators must prioritize updating the Thrive Quiz Builder plugin to at least version 10.9.3.1. Failure to patch will leave the application exposed to trivial exploitation by remote actors.