EUVD-2026-37845
GHSA-ghw7-hv89-j7jq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network REST API (AV:N), trivial complexity (AC:L), requires authenticated teacher session (PR:L), integrity-only impact (I:L) from cross-user rule tampering with no confidentiality or availability consequences.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The PressPrimer Quiz - AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user's quiz structure.
AnalysisAI
Unauthorized cross-teacher quiz rule tampering in the PressPrimer Quiz WordPress plugin (all versions ≤ 2.3.0) is possible via an IDOR flaw in the plugin's REST API, where the rule_id parameter is accepted without ownership validation. Any authenticated user holding a custom-level role or above - such as a teacher - can supply arbitrary rule_id values to modify or delete quiz rules belonging to other teachers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum a custom-level role (e.g., teacher) that has been granted access to the PressPrimer Quiz plugin's REST API endpoints - unauthenticated visitors cannot exploit this flaw (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately characterizes the threat: network-accessible but requiring authentication (PR:L), with scope limited to low-level integrity impact and no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated WordPress teacher logs into a shared LMS site and crafts a REST API request to the plugin's rule update or delete endpoint, substituting the `rule_id` of a quiz rule belonging to a colleague's quiz. Because version 2.3.0 and earlier perform no ownership check, the server accepts the request and modifies or deletes the target rule. … |
| Remediation | Upgrade the PressPrimer Quiz plugin to version 2.3.1 or later, which introduces ownership validation via the `get_owned_quiz_or_error()` method added in commit 1795687 (https://github.com/PressPrimer/pressprimer-quiz/commit/1795687) and tagged `@since 2.3.1` in the plugin source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today