EUVD-2026-39932
GHSA-73vw-76h4-g45m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery requires no attacker privileges, but mandatory admin interaction (UI:R) and scope-limited low integrity impact accurately reflect the CSRF constraint.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation on the hdq_validate_nonce function. This makes it possible for unauthenticated attackers to delete or modify quizzes and questions, create new quizzes, and change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the HD Quiz WordPress plugin versions 2.2.0 and 2.2.1 enables unauthenticated attackers to manipulate quiz content and plugin settings by tricking a logged-in administrator into clicking a crafted link. The flaw originates in the hdq_validate_nonce function (includes/functions.php:39), which fails to properly validate WordPress nonces across at least six distinct AJAX action handlers in includes/actions-ajax.php. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though Wordfence has published a detailed advisory with source code references for both affected versions.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) results from the WordPress plugin's central nonce validation function hdq_validate_nonce in includes/functions.php either being absent or incorrectly implemented. WordPress nonces are time-limited, action-specific tokens embedded in admin forms and AJAX requests to verify the request originates from a legitimate admin session. When validation is missing or bypassed, any cross-origin HTTP request bearing a valid admin session cookie is accepted as authoritative. The vulnerability surfaces in at least six AJAX handlers (actions-ajax.php lines 7, 53, 68, 87, 155, 179) covering operations including quiz creation, modification, deletion, question management, and settings changes. CPE cpe:2.3:a:harmonic_design:hd_quiz:*:*:*:*:*:*:*:* identifies the affected software as produced by Harmonic Design.
RemediationAI
No vendor-released patched version is identified in the available data; the highest confirmed vulnerable version is 2.2.1. Site administrators should check the WordPress.org plugin repository for an update beyond 2.2.1 and apply it immediately if available. In the interim, deactivating the HD Quiz plugin eliminates the attack surface entirely with the trade-off of losing quiz functionality. If deactivation is not acceptable, administrators should apply strict content security and user awareness measures: avoid clicking unsolicited links while logged into the WordPress admin dashboard, enforce short admin session timeouts, and consider a Web Application Firewall rule blocking unauthorized AJAX POST requests to wp-admin/admin-ajax.php with HD Quiz action parameters. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c886ce5a-0633-4892-9471-c1a7ee858c93 should be monitored for patch version confirmation.
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when g
The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high priv
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harmonic Design HD
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today