The Quiz and Survey Master plugin for WordPress, in all releases before 11.2.4, lacks authorization checks on a REST API route that returns question bank entries. A CWE-639 weakness allows a user with a role as low as Contributor to read the questions, hints, and correct answer keys of quizzes created by other users. This unauthorized disclosure permits attackers to read confidential quiz content.

Any WordPress installation that has the QSM plugin installed with a version earlier than 11.2.4 is affected. The vulnerability applies to sites where users with Contributor or higher roles are present. There are no specific sub‑version identifiers, so the entire series of releases before 11.2.4 is considered vulnerable.

Because the flaw, identified as CWE-639, is an IDOR exposed over a public REST endpoint, an attacker merely needs to know the quiz identifier or brute‑force the parameter to retrieve data. No credentials beyond the normal contributor role are required. The EPSS score is <1%, indicating a low likelihood of exploitation. The CVSS score of 2.7 reflects a low impact focused on information disclosure.