{
 "id": "WPSEC-2026-2890",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2890/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2890/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2890/index.md",
 "title": "Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Sensitive Information Exposure via Quiz Finish Response",
 "description": "The Quiz Maker by AYS plugin for WordPress is vulnerable to Sensitive Information Exposure via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98. The handler returns every answer of each submitted question, with its correct flag, in the 'question_answer_data' response field. It does this for any question ID supplied in the 'ays_questions' keys, whether or not the question belongs to the quiz and whether or not the quiz is set to show question results. This makes it possible for unauthenticated attackers to retrieve the correct answers to any question of any quiz on the site.",
 "plugin": {
  "slug": "quiz-maker",
  "name": "Quiz Maker by AYS",
  "full_name": "Quiz Maker by AYS",
  "wordpress_org": "https://wordpress.org/plugins/quiz-maker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-maker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-maker"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.7.0.66",
    "from_inclusive": true,
    "to": "6.7.1.99",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.7.0.66 before 6.7.1.99"
  ]
 },
 "introduced_in": "6.7.0.66",
 "fixed_in": "6.7.1.99",
 "remediation": "Update to 6.7.1.99 or later.",
 "fix_released": "2026-11-10T07:56:35+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:25.767042+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2890/",
  "https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/",
  "https://wordpress.org/plugins/quiz-maker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-maker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}