WordPress Plugin Vulnerabilities

Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

Description

The plugin does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.

Proof of Concept

Affects Plugins

Plugin icon
quiz-master-next
Fixed in 11.2.4

References

CVE
CVE-2026-14825

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
fb66cb33-e16f-47ee-88d6-5cf141e92a4b

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2023-07-10
Title
WooCommerce Ship to Multiple Addresses < 3.8.6 - Customer+ Shipping Address Update
Published
2026-01-20
Title
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution < 3.5.1 - Unauthenticated Privilege Escalation via Account Takeover
Published
2025-11-11
Title
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory < 2.8.140 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Published
2025-03-27
Title
Support Genix < 1.4.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-10-17
Title
Image optimization service by Optimole < 4.1.1 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload