WordPress Plugin Vulnerabilities

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

Description

The plugin does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.

Proof of Concept

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 11.2.4

References

CVE
CVE-2026-14826

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.1 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
bb9cac20-4df5-4834-89f0-746a5eab20ea

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2021-05-17
Title
LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
Published
2026-05-19
Title
Photo Gallery, Sliders, Proofing and Themes < 4.2.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
Published
2026-02-18
Title
Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update
Published
2026-07-16
Title
Ninja Forms - Excel Export < 3.3.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
Published
2022-12-05
Title
ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR