# Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Insecure Direct Object Reference to Cross-Quiz Question Disclosure via qsm_load_page_questions AJAX Action

- **ID:** WPSEC-2026-2892
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** from 11.0.0 before 11.3.1
- **Fixed in:** 11.3.1 (Update to 11.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2892/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to Insecure Direct Object Reference via the qsm_load_page_questions AJAX action (lazy-loaded quiz pages) in all versions up to, and including, 11.3.0, due to questions being fetched by a user-supplied ID without checking that they belong to the quiz the nonce was issued for. This makes it possible for unauthenticated attackers holding the nonce of any public quiz to view questions from other quizzes, including private, draft or password-protected ones.

## References

- https://wpsec.com/vuln/WPSEC-2026-2892/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2892/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.