WordPress Plugin Vulnerabilities

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.6 - Unauthenticated Insecure Direct Object Reference

Description

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 11.2.5. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 11.2.6

References

CVE
CVE-2026-62140
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6763a3-6773-41fe-b7fd-f21c34963bd8

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Adam Kahlon
Verified
No
WPVDB ID
cbf29fe0-2913-460d-9d76-f9804f589f02

Timeline

Publicly Published
2026-09-10 (about 1 month ago)
Added
2026-09-15 (about 1 month ago)
Last Updated
2026-09-15 (about 1 month ago)

Other

Published
Title
Published
2024-10-16
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.7.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Published
2024-04-22
Title
ProfileGrid – User Profiles, Memberships, Groups and Communities < 5.8.0 - Insecure Direct Object Reference
Published
2026-04-06
Title
Amelia < 2.2 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Published
2024-04-30
Title
Masteriyo - LMS < 1.7.4 - Insecure Direct Object Reference
Published
2026-06-17
Title
PressPrimer Quiz < 2.3.1 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters