CVE-2026-79615 in Quiz and Survey Master Plugin
Summary
by MITRE • 08/28/2026
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Quiz and Survey Master (QSM) versions prior to 11.2.4 represents a critical failure in access control mechanisms within the plugin's REST API implementation. Specifically, the endpoint responsible for retrieving question bank entries lacks proper authorization checks, allowing any authenticated user with even minimal privileges, such as the Contributor role, to query and retrieve sensitive data associated with quizzes created by other users. This flaw effectively bypasses the intended isolation between different content creators on a WordPress installation, exposing internal quiz structures that are typically restricted to administrators or specific authors depending on site configuration.
From a technical perspective, this issue falls under CWE-284 Improper Access Control and is closely related to CWE-601 URL Redirection to Untrusted Site in the context of API endpoint exposure if misconfigured, though primarily it is an authorization bypass. The REST API routes provided by QSM were designed to facilitate dynamic loading of quiz data but failed to validate whether the requesting user had permission to access the specific question bank entries being requested. In WordPress architecture, while some default endpoints enforce strict capability checks, custom plugin endpoints often require explicit verification using functions like current_user_can or similar authorization hooks. The absence of these checks in QSM's codebase allowed low-privileged users to exploit this gap by crafting API requests that returned comprehensive details about other users' quizzes.
The operational impact of this vulnerability is significant for organizations relying on WordPress for training, certification, or assessment purposes. Attackers with Contributor-level access can extract the full content of questions, including hints and correct answer keys. This compromises the integrity of assessments, as individuals who should not have prior knowledge of exam contents can gain unfair advantages in testing scenarios. Furthermore, this exposure facilitates information disclosure that could aid in further attacks against the WordPress installation or associated systems by revealing internal logic, question structures, and potentially sensitive data embedded within quiz content.
This vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate but low-privileged user credentials to access unauthorized resources. It also reflects aspects of T1530 Data from Local System, where an attacker collects information stored on the system that they are not authorized to view. The exploitation does not require complex payloads or remote code execution; rather, it relies on simple HTTP requests to exposed API endpoints, making it easily exploitable by automated tools and increasing the risk of widespread compromise in environments with multiple user accounts.
Mitigation strategies for this vulnerability involve immediate updates to Quiz and Survey Master version 11.2.4 or later, where the authorization checks have been implemented correctly within the REST API routes. Administrators should verify that all plugins are up-to-date and review WordPress role capabilities to ensure that users with low privileges do not require access to quiz management features unless absolutely necessary. Additionally, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by monitoring for unusual patterns in API requests from low-privileged accounts. Regular security audits focusing on REST API endpoints are recommended to detect similar authorization flaws in other plugins or custom code within the WordPress ecosystem.