CVE-2023-0292 in Quiz and Survey Master Plugin
Summary
by MITRE • 06/09/2023
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-0292 affects the Quiz And Survey Master plugin for WordPress, a widely used tool for creating interactive quizzes and surveys on WordPress websites. This particular flaw exists in versions up to and including 8.0.8, representing a significant security risk for WordPress site administrators who have not updated their installations. The vulnerability manifests through a cross-site request forgery weakness that allows attackers to manipulate the plugin's functionality without proper authentication, potentially leading to unauthorized file deletion operations that could compromise the integrity and availability of website content.
The technical root cause of this vulnerability lies in the absence of proper nonce validation within the qsm_remove_file_fd_question AJAX action handler. A nonce is a cryptographic token that ensures requests originate from legitimate sources and prevents unauthorized operations from being executed. In this case, the plugin fails to verify the authenticity of requests made to the file deletion endpoint, creating an opening for malicious actors to craft forged requests. This specific implementation flaw falls under the category of CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities in web applications. The vulnerability is particularly dangerous because it requires minimal user interaction to exploit, as administrators can be tricked into executing malicious requests through social engineering tactics such as clicking on malicious links.
The operational impact of this vulnerability extends beyond simple data loss, as it provides attackers with the capability to delete arbitrary media files from the WordPress installation. This can result in significant disruption to website functionality, as deleted files may include critical images, documents, or other media assets that are essential for quiz displays and user interactions. Attackers could potentially target specific files to degrade the user experience or even delete core plugin files that could prevent the quiz functionality from working properly. The unauthenticated nature of this attack means that no prior access to the WordPress admin panel or valid user credentials are required, making it particularly attractive to threat actors who seek to exploit weak points in web application security.
The exploitation of this vulnerability aligns with ATT&CK technique T1213.002, which involves accessing data through unsecured files or directories, and demonstrates how attackers can leverage missing security controls to gain unauthorized access to system resources. Organizations using the affected plugin version should immediately implement mitigations including updating to the patched version, implementing proper input validation, and monitoring for unauthorized file deletion activities. Additionally, site administrators should consider implementing additional security measures such as restricting file upload capabilities, implementing web application firewalls, and conducting regular security audits to identify and remediate similar vulnerabilities. The incident also highlights the importance of proper security testing during plugin development, particularly around AJAX endpoints that handle sensitive operations, and underscores the need for robust authentication and authorization mechanisms in WordPress plugins to prevent such critical security gaps from being introduced into production environments.