The QSM plugin lacks a capability check on the qsm_dashboard_delete_result function. As a result, any authenticated user with Subscriber-level access or higher can invoke this function and delete quiz results stored by the plugin. This vulnerability enables loss of user data but does not grant broader system compromise or privilege escalation. The primary impact is integrity loss of quiz result data.

The issue affects the ExpressTech Quiz and Survey Master WordPress plugin, versions 10.3.1 and earlier.

The CVSS score of 4.3 categorizes this deficiency as moderate severity. An EPSS score below 1% suggests that exploitation is unlikely in the general population, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress account with at least Subscriber role, so attackers must first compromise or gain access to a legitimate user account. Once authenticated, they can run the deletion action without additional privileges, making the attack path straightforward for insiders or users who have shared credentials.