EUVD-2026-67572
GHSA-p22c-6jvf-q7g6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor is a low-privilege WordPress role (PR:L), not high; network-accessible, no complexity, confidentiality-only disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.
AnalysisAI
Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid WordPress account with at least Contributor role on the target site - anonymous or unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS score of 2.7 (PR:H) conflicts materially with the description, which states exploitation is possible with a role 'as low as Contributor' - in WordPress, Contributor maps to PR:L (low privileges), not PR:H (administrator). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Quiz and Survey Master (QSM) to version 11.2.4 or later, which introduces the missing authorization check on the affected REST API route. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Quiz And Survey Master Qsm
View allUsername enumeration and brute-force password attempt in Quiz and Survey Master WordPress plugin before 11.1.3 allows un
Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level
The Quiz and Survey Master WordPress plugin before version 11.1.5 permits authenticated users with contributor-level per
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today