An Insecure Direct Object Reference (IDOR) flaw exists in the ExpressTech Systems Quiz And Survey Master plugin that lets an attacker manipulate a user‑controlled key to bypass correctly configured access control security levels. The flaw allows unauthorized users to view or modify protected quiz or survey data, effectively elevating privileges without requiring valid credentials. This represents a clear authorization bypass vulnerability, potentially exposing sensitive user responses or administrative data.

The vulnerability affects the WordPress Quiz And Survey Master plugin, version 10.3.4 and all earlier releases. Any site running the plugin within this version range is potentially impacted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation as of the current data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote web‑based request to the plugin’s endpoints where the attacker can tamper with the key parameter. The vulnerability does not provide an immediate remote code execution path, but it does enable privilege escalation and potential data exposure through unauthorized access.