The HD Quiz plugin for WordPress allows unauthenticated attackers to manipulate quiz content and settings through a form of Cross‑Site Request Forgery. The flaw stems from the hdq_validate_nonce function lacking proper nonce validation, enabling attackers to delete, modify, create quizzes, or change plugin settings without authorization. The primary impact is the unauthorized alteration of site data and configuration, potentially affecting the integrity of quizzes and user experience.

Any WordPress site running HD Quiz versions 2.2.0 or 2.2.1 is affected. Vendors Harmonic Design released the plugin under the name HD Quiz, and these specific minor releases are vulnerable. No other specific versions are listed as impacted.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. EPSS data is not available, and the issue is not listed in CISA KEV. A likely attack vector requires an administrator or a user with administrative privileges to unknowingly follow a crafted link or submit a forged request, giving attackers the ability to send malicious AJAX requests. Exploitation thus depends on social engineering or compromised credentials.