CVE-2022-4220 in Chained Quiz Plugin
Summary
by MITRE • 12/03/2022
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
The Chained Quiz plugin for WordPress represents a widely used educational tool that enables administrators to create interactive quizzes and assessments for their websites. This particular vulnerability affects versions up to and including 1.3.2.4, where the plugin fails to implement proper security measures for validating user requests. The vulnerability stems from a critical flaw in the list_questions() function which lacks nonce validation, creating an exploitable condition that undermines the plugin's security posture.
The technical flaw manifests as a complete absence of nonce verification within the list_questions() function, which is responsible for handling quiz question management operations. A nonce is a cryptographic value that ensures requests originate from legitimate sources and prevents unauthorized actions from being executed on behalf of authenticated users. Without this validation mechanism, attackers can craft malicious requests that appear to come from legitimate administrative sessions. This represents a classic cross-site request forgery vulnerability classified under CWE-352, where the application fails to validate the source of requests, allowing unauthorized operations to be performed.
The operational impact of this vulnerability extends beyond simple data manipulation, as it provides attackers with the capability to delete quiz questions from existing quizzes. This compromise can severely disrupt educational content delivery and assessment processes, potentially affecting thousands of users who rely on these quizzes for learning or evaluation purposes. The vulnerability is particularly dangerous because it requires minimal user interaction from the administrator, who only needs to be tricked into clicking a malicious link. This social engineering aspect makes the attack vector highly effective and difficult to prevent through traditional security measures alone.
The attack scenario involves an attacker crafting a forged request that targets the list_questions() function and submitting it to the vulnerable WordPress installation. When an administrator clicks on a malicious link containing this forged request, the system processes the deletion operation without proper authentication verification. This behavior aligns with ATT&CK technique T1566.001 for social engineering through phishing attacks, where attackers manipulate users into performing actions that compromise system security. The vulnerability creates a persistent risk for organizations that depend on the Chained Quiz plugin for educational content management, as it allows attackers to systematically remove quiz content and disrupt the learning experience.
Organizations should immediately update to the latest version of the Chained Quiz plugin where the nonce validation has been implemented to address this vulnerability. Security administrators should also consider implementing additional protective measures such as monitoring for suspicious administrative actions and reviewing access logs for unusual patterns. The vulnerability demonstrates the critical importance of proper input validation and authentication mechanisms in web applications, particularly those handling user-generated content or administrative functions. This incident underscores the need for comprehensive security testing including penetration testing and code review processes to identify similar flaws in other plugins and themes before they can be exploited by malicious actors.