The Quiz and Survey Master plugin suffers from a missing authorization check (CWE-862). An authenticated user with Contributor or higher privileges can first call the "/quiz/structure" endpoint with another user’s quiz ID to retrieve a valid nonce. That nonce can then be presented to the "/quizzes/{id}/emails save" endpoint, which accepts it without verifying that the requester owns the quiz. The attacker can therefore overwrite the quiz’s result page and redirect notification emails to arbitrary addresses, effectively altering quiz content and email delivery.

All releases of the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin by expresstech up through and including version 11.1.4 are affected. The flaw is relevant for any WordPress installation that grants Contributor or higher role users the ability to manage quizzes.

The CVSS score of 4.3 indicates moderate severity for authenticated attackers. With an EPSS score of less than 1% and no presence in the CISA KEV catalog, the likelihood of exploitation is low, but the attack is straightforward for users who already have contributor-level access. The exploitation path requires no special code execution, merely authenticating, obtaining a nonce via the public REST endpoint, and submitting it to the protected endpoint. If a site’s contributor users can edit quizzes, the attacker can modify results pages and redirect email notifications.