Vulnerabilities / Quiz and Survey Master (QSM) / WPSEC-2026-2892
Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Insecure Direct Object Reference to Cross-Quiz Question Disclosure via qsm_load_page_questions AJAX Action
Medium 5.3
CWE-639Fixed in 11.3.1
- ID
- WPSEC-2026-2892
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- from 11.0.0 before 11.3.1
- Remediation
- Update to 11.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz and Survey Master (QSM) on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Insecure Direct Object Reference via the qsm_load_page_questions AJAX action (lazy-loaded quiz pages) in all versions up to, and including, 11.3.0, due to questions being fetched by a user-supplied ID without checking that they belong to the quiz the nonce was issued for. This makes it possible for unauthenticated attackers holding the nonce of any public quiz to view questions from other quizzes, including private, draft or password-protected ones.
References
- https://wpsec.com/vuln/WPSEC-2026-2892/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS