WordPress Plugin Vulnerabilities

Quiz And Survey Master < 8.0.9 - Unauthenticated Arbitrary Media File Delete

Description

The plugin does not properly check user capabilities for the qsm_remove_file_fd_question AJAX action, enabling unauthorized users to delete arbitrary media files. It also does not properly validate nonce on the qsm_remove_file_fd_question AJAX action, resulting in a Cross-Site Request Forgery vulnerability

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 8.0.9

References

CVE
CVE-2023-0292
CVE
CVE-2023-0291
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quiz-master-next/quiz-and-survey-master-808-cross-site-request-forgery-to-arbitrary-media-deletion

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Julien Ahrens
Verified
No
WPVDB ID
0dd16d30-9543-4c1c-8e23-fb139ffed1f2

Timeline

Publicly Published
2023-02-08 (about 3 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2025-12-04
Title
Projectopia – WordPress Project Management < 5.1.20 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Published
2025-01-16
Title
PAPERCITE <= 0.5.18 - Missing Authorization
Published
2024-04-05
Title
All-in-One Video Gallery < 3.6.0 - Missing Authorization
Published
2026-01-26
Title
CLP Varnish Cache < 1.0.3 - Missing Authorization
Published
2019-06-15
Title
Real Estate Manager < 7.0 - Subscriber+ Settings Update