# Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Quiz Score Manipulation via Quiz Submission

- **ID:** WPSEC-2026-2889
- **Plugin:** Quiz Maker by AYS (`quiz-maker`), https://wordpress.org/plugins/quiz-maker/
- **Affected versions:** all versions before 6.7.1.99
- **Fixed in:** 6.7.1.99 (Update to 6.7.1.99 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-maker
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2889/

## Description

The Quiz Maker by AYS plugin for WordPress is vulnerable to quiz result manipulation via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98, due to insufficient validation of the submitted answers. The handler grades only the questions present in the submitted 'ays_questions' keys and computes the score over the weight of those questions alone. It does not check that the questions belong to the quiz or that all of the quiz's questions were answered. This makes it possible for unauthenticated attackers to record passing or perfect quiz results by submitting answers for a chosen subset of questions, or for questions from other quizzes.

## References

- https://wpsec.com/vuln/WPSEC-2026-2889/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/
- https://wordpress.org/plugins/quiz-maker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2889/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.