{
 "id": "WPSEC-2026-2889",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2889/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2889/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2889/index.md",
 "title": "Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Quiz Score Manipulation via Quiz Submission",
 "description": "The Quiz Maker by AYS plugin for WordPress is vulnerable to quiz result manipulation via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98, due to insufficient validation of the submitted answers. The handler grades only the questions present in the submitted 'ays_questions' keys and computes the score over the weight of those questions alone. It does not check that the questions belong to the quiz or that all of the quiz's questions were answered. This makes it possible for unauthenticated attackers to record passing or perfect quiz results by submitting answers for a chosen subset of questions, or for questions from other quizzes.",
 "plugin": {
  "slug": "quiz-maker",
  "name": "Quiz Maker by AYS",
  "full_name": "Quiz Maker by AYS",
  "wordpress_org": "https://wordpress.org/plugins/quiz-maker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-maker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-maker"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.7.1.99",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.7.1.99"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.7.1.99",
 "remediation": "Update to 6.7.1.99 or later.",
 "fix_released": "2026-11-10T07:56:35+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:25.767042+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2889/",
  "https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/",
  "https://wordpress.org/plugins/quiz-maker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-maker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}