WordPress Plugin Vulnerabilities

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

Description

The plugin does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 11.2.4

References

CVE
CVE-2026-79615

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.vercel.app
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
f4c77fda-edc2-44c5-95d9-358636896b5f

Timeline

Publicly Published
2026-08-26 (about 2 days ago)
Added
2026-08-26 (about 1 day ago)
Last Updated
2026-08-26 (about 1 day ago)

Other

Published
Title
Published
2026-03-29
Title
Download Monitor < 5.1.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Published
2026-08-10
Title
WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart
Published
2026-03-12
Title
GetGenie < 4.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
Published
2024-03-29
Title
Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-08-12
Title
WP Job Portal < 2.1.9 - Subscriber+ Insecure Direct Object Reference