WordPress Plugin Vulnerabilities

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker < 10.3.5 - Unauthenticated Insecure Direct Object Reference

Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.3.4 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to [describe the impact of the vulnerability].

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 10.3.5

References

CVE
CVE-2026-25324
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a67ab966-c179-4ea6-bf8c-bc22f9b4644b

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
johska
Verified
No
WPVDB ID
0c32ca89-0caa-4de1-9406-ccc9661143b9

Timeline

Publicly Published
2026-02-01 (about 8 months ago)
Added
2026-05-04 (about 5 months ago)
Last Updated
2026-05-04 (about 5 months ago)

Other

Published
Title
Published
2026-09-21
Title
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
Published
2023-02-27
Title
WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR
Published
2026-03-05
Title
Subscription for WooCommerce – WordPress Recurring Payments Plugin < 1.8.11 - Authenticated (Customer+) Insecure Direct Object Reference
Published
2026-03-11
Title
WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-09-07
Title
Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR