# Quiz Maker by AYS <= 6.7.1.98 - Unauthenticated Sensitive Information Exposure via Quiz Finish Response

- **ID:** WPSEC-2026-2890
- **Plugin:** Quiz Maker by AYS (`quiz-maker`), https://wordpress.org/plugins/quiz-maker/
- **Affected versions:** from 6.7.0.66 before 6.7.1.99
- **Fixed in:** 6.7.1.99 (Update to 6.7.1.99 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-maker
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2890/

## Description

The Quiz Maker by AYS plugin for WordPress is vulnerable to Sensitive Information Exposure via the ays_finish_quiz AJAX action in all versions up to, and including, 6.7.1.98. The handler returns every answer of each submitted question, with its correct flag, in the 'question_answer_data' response field. It does this for any question ID supplied in the 'ays_questions' keys, whether or not the question belongs to the quiz and whether or not the quiz is set to show question results. This makes it possible for unauthenticated attackers to retrieve the correct answers to any question of any quiz on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-2890/
- https://plugins.svn.wordpress.org/quiz-maker/tags/6.7.1.99/
- https://wordpress.org/plugins/quiz-maker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2890/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.