Description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Published: 2026-08-19
Score: 2.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Quiz and Survey Master WordPress plugin allows an insecure direct object reference in the REST API to expose email‑notification and results‑page configuration data for quizzes. The exposed data includes recipient addresses that could be harvested for phishing or spam. The vulnerability does not grant code execution or privilege escalation, but it leaks sensitive configuration information to users beyond the quiz owner.

Affected Systems

Any WordPress installation running Quiz and Survey Master version earlier than 11.2.4 is vulnerable. Contributors or higher users can utilize the exposed REST routes to read other users' quiz configuration settings.

Risk and Exploitability

The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog. While exploitation is unlikely, the leaked configuration data could be used in future phishing or spam campaigns, so remediation is recommended.

Generated by OpenCVE AI on August 20, 2026 at 16:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Quiz and Survey Master plugin to version 11.2.4 or later.
  • If an immediate upgrade is not possible, add a custom filter that checks the current user's capability and blocks access to the vulnerable REST endpoints for non‑administrator roles; this can be done in a small plugin or the theme’s functions.php file.
  • Reevaluate the need for contributor-level access on your site and consider downgrading or removing the role if it is not required, or replace it with a custom role that lacks the capability to access the affected endpoint.

Generated by OpenCVE AI on August 20, 2026 at 16:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Quizandsurveymaster
Quizandsurveymaster quiz And Survey Master
Wordpress
Wordpress wordpress
Vendors & Products Quizandsurveymaster
Quizandsurveymaster quiz And Survey Master
Wordpress
Wordpress wordpress

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-639
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Title Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
References

Subscriptions

Quizandsurveymaster Quiz And Survey Master
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-19T13:14:55.802Z

Reserved: 2026-07-06T08:45:48.527Z

Link: CVE-2026-14826

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-19T06:17:33.890

Modified: 2026-08-26T16:30:52.723

Link: CVE-2026-14826

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:45:03Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key