The Chained Quiz plugin for WordPress contains an insecure direct object reference flaw because it accepts a user‑controlled value in the chained_completion_id cookie without validating that the cookie refers to a quiz attempt belonging to the current visitor. An attacker who sets this cookie to any identifier can make the plugin load the corresponding attempt as if the visitor were that user, thereby viewing and permanently changing the answers, scores, and final results of other users. This vulnerability does not grant remote code execution, but it compromises the confidentiality and integrity of quiz data relied upon by the site.

WordPress sites that have installed the Chained Quiz plugin from the prasunsen developer with version 1.3.4 or earlier are affected. Versions 1.3.4 and 1.3.5 contain only a partial patch and are likely still vulnerable, so sites using these releases should treat them as compromised. The plugin is available through the official WordPress repository and has been noted in Wordfence vulnerability notices.

The flaw has a CVSS score of 5.3, signalling moderate severity for an unauthenticated exploit. An EPSS score of 3% indicates a low but non‑zero likelihood of exploitation in the wild; it is not listed in the CISA KEV catalog. The attack path is straightforward: an unauthenticated user merely needs to set a crafted chained_completion_id cookie and send the request to the target. No additional privileges or conditions are required, and the impact is limited to the data integrity and confidentiality of quiz attempts for all site users.