This vulnerability (CVE-2026-59544) affects Thrive Quiz Builder, a product by Thrive Themes Coupon. It is caused by unsafe deserialization of untrusted data (CWE-502) leading to unauthenticated PHP object injection in versions up to 10.9.3.0. The vulnerability allows remote attackers to execute arbitrary code without requiring any privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including complete loss of confidentiality, integrity, and availability. Attackers can execute arbitrary code remotely without authentication, potentially leading to system takeover, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Thrive Themes' official channels for updates and apply any released patches promptly once available. Until a fix is released, restricting access to the affected component or disabling the plugin may reduce exposure.