Quiz Maker CVE-2025-12426

No special conditions - remote unauthenticated exploitation against default configurations of the Quiz Maker WordPress plugin (≤6.7.0.80); the only prerequisite is that the target site has the plugin active with at least one quiz published, since the attacker needs a public quiz page to scrape the quiz_maker_ajax_public nonce before replaying it to the ays_quiz_check_answer AJAX action. The practical limiting factor is scope of impact, not access difficulty: exploitation yields only quiz answers, so sites without sensitive/graded quizzes face negligible consequences even though the endpoint is fully reachable without authentication.

Signals are mostly consistent and point to a genuine but moderate-severity issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the description corroborates this, since the ays_quiz_check_answer AJAX action only checks a nonce that is itself published to every site visitor via the quiz_maker_ajax_public localized script, effectively nullifying the authorization control. Impact is confidentiality-only (C:H/I:N/A:N): an attacker can read quiz answers but cannot alter or disrupt the site. EPSS is low (0.10%, 28th percentile) and there is no CISA KEV listing and no POC referenced in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. I regard NVD's C:H as arguably overstated: the exposed data is limited to quiz answers, not credentials or broad personal data, so the real-world confidentiality loss is narrow (reflected in my independent assessment below). Net: a legitimately exploitable, trivially-weaponizable unauthenticated info-disclosure flaw, but one whose practical damage is confined to defeating quiz integrity; prioritize patching for any site that relies on quiz confidentiality (graded tests, certification quizzes), but it is not a critical mass-exploitation risk.

An unauthenticated visitor loads any public page containing a Quiz Maker quiz, scrapes the publicly-exposed nonce from the quiz_maker_ajax_public localized script, and replays it against the ays_quiz_check_answer AJAX endpoint. Iterating over question IDs, the attacker harvests the correct answers for every quiz question - allowing them to cheat on graded or certification quizzes or dump proprietary quiz content. No POC is referenced in the input, but the attack is trivial given AV:N/AC:L/PR:N.