Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Published: 2026-08-19
Score: 2.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a contributor or higher to modify the front‑end text settings of quizzes that were created by other users because the plugin does not verify the owner of the quiz before saving the settings. This flaw could enable an attacker to change quiz content or display, potentially misleading respondents or defacing a quiz.\n

Affected Systems

This flaw affects the Quiz and Survey Master WordPress plugin prior to version 11.2.4. Any installation running a version earlier than 11.2.4 is potentially vulnerable; there is no official back‑port or patch beyond that version.\n

Risk and Exploitability

The CVSS score of 2.7 indicates low overall impact. The EPSS score of less than 1% suggests that exploitation in the wild is very unlikely, and the flaw is not listed in the CISA KEV catalog. Attackers would need contributor or higher WordPress roles and can exploit the issue through the front‑end editing interface, but the damage is limited to tampering with quiz text content.

Generated by OpenCVE AI on August 20, 2026 at 17:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Quiz and Survey Master to version 11.2.4 or later.
  • If an upgrade cannot be performed immediately, restrict contributors and higher roles from editing quiz front‑end text settings or remove those capabilities altogether.
  • Apply a custom patch or configuration change that enforces ownership checks before saving quiz text settings to prevent non‑owners from making modifications.

Generated by OpenCVE AI on August 20, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Quizandsurveymaster
Quizandsurveymaster quiz And Survey Master
Wordpress
Wordpress wordpress
Vendors & Products Quizandsurveymaster
Quizandsurveymaster quiz And Survey Master
Wordpress
Wordpress wordpress

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-639
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Title Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR
References

Subscriptions

Quizandsurveymaster Quiz And Survey Master
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-19T13:14:24.772Z

Reserved: 2026-07-06T08:45:46.381Z

Link: CVE-2026-14825

cve-icon Vulnrichment

Updated: 2026-08-19T13:14:19.114Z

cve-icon NVD

Status : Deferred

Published: 2026-08-19T06:17:33.610

Modified: 2026-08-26T16:30:52.723

Link: CVE-2026-14825

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:45:03Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key