{
 "id": "WPSEC-2026-2892",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2892/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2892/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2892/index.md",
 "title": "Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Insecure Direct Object Reference to Cross-Quiz Question Disclosure via qsm_load_page_questions AJAX Action",
 "description": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Insecure Direct Object Reference via the qsm_load_page_questions AJAX action (lazy-loaded quiz pages) in all versions up to, and including, 11.3.0, due to questions being fetched by a user-supplied ID without checking that they belong to the quiz the nonce was issued for. This makes it possible for unauthenticated attackers holding the nonce of any public quiz to view questions from other quizzes, including private, draft or password-protected ones.",
 "plugin": {
  "slug": "quiz-master-next",
  "name": "Quiz and Survey Master (QSM)",
  "full_name": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
  "wordpress_org": "https://wordpress.org/plugins/quiz-master-next/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quiz-master-next/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quiz-master-next"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "11.0.0",
    "from_inclusive": true,
    "to": "11.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 11.0.0 before 11.3.1"
  ]
 },
 "introduced_in": "11.0.0",
 "fixed_in": "11.3.1",
 "remediation": "Update to 11.3.1 or later.",
 "fix_released": "2026-11-11T10:38:37+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:29.032691+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2892/",
  "https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/",
  "https://wordpress.org/plugins/quiz-master-next/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quiz-master-next",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}