CVE-2026-14821 in Quiz and Survey Master Plugin
Summary
by MITRE • 07/28/2026
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Quiz and Survey Master plugin for WordPress represents a widely used tool for creating interactive assessments and surveys within web applications. This particular vulnerability affects versions prior to 11.1.5 where the plugin fails to implement proper capability checks during template deletion operations. The flaw exists in the administrative interface where users with contributor-level privileges or higher can manipulate the system to remove output templates that they should not have access to modify or delete.
This security weakness stems from insufficient input validation and access control mechanisms within the plugin's template management functionality. When users attempt to delete templates through the administrative dashboard, the system does not verify whether the authenticated user possesses the necessary permissions to perform such destructive actions. The vulnerability specifically impacts the plugin's ability to enforce role-based access controls, allowing unauthorized template removal that could disrupt existing quiz and survey configurations.
The operational impact of this vulnerability extends beyond simple template deletion as it enables attackers with contributor-level accounts to potentially compromise the integrity of assessment systems. An attacker could delete critical templates used by other users, causing disruption to quiz functionality and potentially leading to data loss or system instability. This type of privilege escalation allows unauthorized modification of system resources that should remain protected from lower-privilege users.
From a security standards perspective, this vulnerability aligns with CWE-285, which addresses insufficient authorization issues in software applications. The flaw demonstrates poor access control implementation where the system fails to validate user permissions before executing sensitive operations. Additionally, this weakness could be categorized under ATT&CK technique T1078 for valid accounts and T1496 for resource hijacking, as it enables unauthorized modification of application resources through legitimate user accounts.
Mitigation strategies should focus on implementing proper capability checks that verify user roles before allowing template deletion operations. Administrators should immediately update to QSM version 11.1.5 or later where this vulnerability has been addressed through enhanced access controls and input validation mechanisms. Additional protective measures include restricting contributor-level privileges to only essential functions, implementing monitoring for template modification activities, and conducting regular security audits of plugin configurations to ensure proper access control enforcement throughout the WordPress environment.