Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Quiz Score Manipulation via Quiz Submission
- ID
- WPSEC-2026-2889
- Plugin
- Quiz Maker by AYS (quiz-maker)
- Affected
- all versions before 6.7.1.99
- Remediation
- Update to 6.7.1.99 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz Maker by AYS on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz Maker by AYS plugin for WordPress is vulnerable to quiz result manipulation via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98, due to insufficient validation of the submitted answers. The handler grades only the questions present in the submitted 'ays_questions' keys and computes the score over the weight of those questions alone. It does not check that the questions belong to the quiz or that all of the quiz's questions were answered. This makes it possible for unauthenticated attackers to record passing or perfect quiz results by submitting answers for a chosen subset of questions, or for questions from other quizzes.
References
- https://wpsec.com/vuln/WPSEC-2026-2889/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/
- https://wordpress.org/plugins/quiz-maker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS