EUVD-2026-76216
GHSA-8w4v-9c8x-pcjp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network exploitation with read-only confidentiality impact; no integrity or availability impact and no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
AnalysisAI
Unauthenticated IDOR in Quiz And Survey Master WordPress plugin (versions ≤ 11.2.5) allows remote attackers to access quiz or survey objects they are not authorized to view by manipulating user-controlled resource identifiers. The flaw carries a CVSS 5.3 (C:L/I:N/A:N), meaning impact is limited to confidentiality - no data modification or denial of service is possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - PR:N and AC:L in the CVSS vector confirm this is exploitable by any unauthenticated remote HTTP client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 medium rating is reasonable given the limited blast radius: exploitation is network-accessible and requires no authentication or user interaction, but the impact is strictly read-only (C:L, I:N, A:N) with no scope change (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Quiz And Survey Master to a version beyond 11.2.5 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-5-insecure-direct-object-references-idor-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Quiz And Survey Master
View allThe Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_i
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the r
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. Rated
The Quiz And Survey Master - Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL I
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz s
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Rated critical severity (CVSS 9.8), this v
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields befo
The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, w
Share
External POC / Exploit Code
Leaving vuln.today