The vulnerability in the Quiz and Survey Master plugin is a missing authorization flaw (CWE-862) that allows an authenticated attacker with contributor‑level or higher not own. By first calling the /quiz/structure endpoint with a victim’s quiz, the attacker can obtain a valid nonce bound to that quiz ID and their own user ID. The attacker can then submit that nonce to the /quizzes/{id}/emails save endpoint, which accepts it without verifying quiz ownership, allowing them to overwrite quiz result pages and redirect quiz‑result notification emails to attacker‑controlled addresses.

All versions of Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker by expresstech, from its earliest release up through version 11.1.4, are affected. The issue originates in the /quiz/structure and /quizzes/{id}/emails save REST API endpoints, regardless of the plugin’s configuration. This vulnerability specifically impacts installations where WordPress users with Contributor or higher role have access to quizzes.

The CVSS score of 4.3 indicates moderate severity for authenticated attackers. This vulnerability, not listed in KEV, has an EPSS score of < 1%. Exploitation requires an authenticated WordPress user with Contributor or higher role and an existing quiz; the attacker obtains a valid nonce from the /quiz/structure to the /quizzes/{id}/emails save endpoint, bypassing ownership checks. This enables unauthorized modifications of quizzes, including changing quiz results pages and redirecting quiz‑result notification emails to attacker‑controlled addresses.