CVE-2026-14825 in Quiz and Survey Master Plugin
Summary
by MITRE • 08/19/2026
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Quiz and Survey Master (QSM) versions prior to 11.2.4 represents a critical failure in object-level authorization controls within the WordPress plugin ecosystem. This flaw specifically affects the mechanism used to save front-end text settings for quizzes, which are often customized by content creators to match their branding or pedagogical needs. The core technical deficiency lies in the absence of a per-object ownership check during the update process. In secure software architecture, any operation that modifies data associated with a specific resource must verify that the requesting user has explicit permission to act upon that particular instance of the resource. QSM fails to validate whether the authenticated user is the actual creator or an authorized administrator of the quiz being modified. Instead, it relies on broader role-based permissions, assuming that users with contributor-level access and above have blanket authority over all quizzes within the system. This design oversight creates a direct path for unauthorized modification of arbitrary quiz configurations.
From a technical perspective, this vulnerability is classified under CWE-284, which denotes Improper Access Control. The flaw allows an attacker to bypass intended security restrictions by exploiting the lack of object-level validation. When a user with contributor or higher privileges submits a request to update quiz text settings, the application processes the change without verifying if that specific quiz belongs to them. This enables horizontal privilege escalation in terms of data manipulation, where one user can alter the state of resources owned by another peer-level user. The impact is particularly significant because front-end text settings often include labels, instructions, and feedback messages displayed directly to end-users taking the quiz or survey. An attacker could modify these texts to display misleading information, phishing content, or offensive material, thereby compromising the integrity of the assessment process and potentially damaging the reputation of the site owner or the original quiz creator.
The operational impact extends beyond simple data corruption. In educational platforms or corporate training environments utilizing QSM, quizzes are often central to certification processes or knowledge assessments. Unauthorized modification of text settings can lead to confusion among participants, incorrect answers being suggested through altered feedback messages, or even social engineering attacks if malicious links or deceptive instructions are injected into the quiz interface. Furthermore, this vulnerability undermines trust in the platform's security model, as it demonstrates that role-based access control alone is insufficient for protecting user-generated content without additional object-level safeguards. Attackers with relatively low privileges can achieve significant influence over shared resources, potentially disrupting workflows and causing operational downtime while administrators investigate and remediate the tampered quizzes.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the Quiz and Survey Master plugin to version 11.2.4 or later, where this specific authorization check has been implemented by the developers. For environments where upgrading is not immediately feasible, administrators should restrict contributor-level access if possible, limiting such users to viewing only their own content rather than editing shared resources. Additionally, implementing a Web Application Firewall with rules that detect anomalous patterns in quiz update requests can provide an additional layer of defense, although this is less effective than fixing the root cause. Developers and security auditors should review similar endpoints within the plugin for comparable flaws, ensuring that all write operations enforce strict ownership verification against the authenticated user's identity. Adhering to OWASP guidelines on broken access control will help prevent recurrence in future updates or related plugins.