Vulnerabilities / Quiz Maker by AYS / WPSEC-2026-2890
Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Sensitive Information Exposure via Quiz Finish Response
Medium 5.3
CWE-200Fixed in 6.7.1.99
- ID
- WPSEC-2026-2890
- Plugin
- Quiz Maker by AYS (quiz-maker)
- Affected
- from 6.7.0.66 before 6.7.1.99
- Remediation
- Update to 6.7.1.99 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz Maker by AYS on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz Maker by AYS plugin for WordPress is vulnerable to Sensitive Information Exposure via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98. The handler returns every answer of each submitted question, with its correct flag, in the 'question_answer_data' response field. It does this for any question ID supplied in the 'ays_questions' keys, whether or not the question belongs to the quiz and whether or not the quiz is set to show question results. This makes it possible for unauthenticated attackers to retrieve the correct answers to any question of any quiz on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2890/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/
- https://wordpress.org/plugins/quiz-maker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS