What is the CVSS score of CVE-2026-10623?

CVE-2026-10623 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

PressPrimer Quiz CVE-2026-10623

EUVD-2026-37845 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-18 Wordfence

GHSA-ghw7-hv89-j7jq

WordPress Authentication Bypass Wordpress Plugin Pressprimer Quiz Ai Quiz Maker Exam Builder Lms Assessment Plugin

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network REST API (AV:N), trivial complexity (AC:L), requires authenticated teacher session (PR:L), integrity-only impact (I:L) from cross-user rule tampering with no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 06:20 vuln.today

Analysis Generated

Jun 18, 2026 - 06:20 vuln.today

CVE Published

Jun 18, 2026 - 05:34 cve.org

MEDIUM 4.3

DescriptionCVE.org

The PressPrimer Quiz - AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user's quiz structure.

AnalysisAI

Unauthorized cross-teacher quiz rule tampering in the PressPrimer Quiz WordPress plugin (all versions ≤ 2.3.0) is possible via an IDOR flaw in the plugin's REST API, where the rule_id parameter is accepted without ownership validation. Any authenticated user holding a custom-level role or above - such as a teacher - can supply arbitrary rule_id values to modify or delete quiz rules belonging to other teachers. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV; the CVSS 3.1 score of 4.3 (PR:L, I:L) reflects the authentication requirement and integrity-only impact.

Technical ContextAI

The vulnerability resides in the WordPress REST API controller class-ppq-rest-controller.php of the PressPrimer Quiz plugin, affected across all releases through 2.3.0 per CPE cpe:2.3:a:pressprimer:pressprimer_quiz_-_ai_quiz_maker,_exam_builder_&_lms_assessment_plugin:*:*:*:*:*:*:*:*. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the API accepts the caller-supplied rule_id as the target resource identifier but does not verify that the referenced quiz rule belongs to the authenticated user's quiz. The fix introduced in version 2.3.1 (commit 1795687) adds a centralized get_owned_quiz_or_error() method that loads the quiz by ID, checks that owner_id matches get_current_user_id() (with an admin bypass for the pressprimer_quiz_manage_all capability), and cross-validates that each rule_id is actually associated with the URL-specified quiz before any mutation is permitted. The same ownership pattern was retroactively applied to quiz items and reordering endpoints in the same patch.

RemediationAI

Upgrade the PressPrimer Quiz plugin to version 2.3.1 or later, which introduces ownership validation via the get_owned_quiz_or_error() method added in commit 1795687 (https://github.com/PressPrimer/pressprimer-quiz/commit/1795687) and tagged @since 2.3.1 in the plugin source. The patch applies the ownership check across all REST API endpoints for quiz rules and items, including create, update, delete, and reorder operations. As a compensating control pending upgrade, administrators can restrict the teacher or custom role from invoking the plugin's REST API endpoints using a WordPress capability filter or a WAF rule targeting the relevant REST routes - note that doing so will disable quiz editing for those users until the upgrade is applied. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/150ac796-d77b-4915-8bbf-9f9b54be8eaf provides additional context.