Vulnerabilities / Quiz and Survey Master (QSM) / WPSEC-2026-2893
Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via qsm_hidden_questions Parameter
Medium 5.3
CWE-472Fixed in 11.3.1
- ID
- WPSEC-2026-2893
- Plugin
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (quiz-master-next)
- Affected
- all versions before 11.3.1
- Remediation
- Update to 11.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Quiz and Survey Master (QSM) on WPSec AttackSurface
- Fix released
- Published
Description
The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.3.0, due to the plugin trusting the client-supplied list of hidden questions, which excludes those questions from both the earned points and the percentage denominator. This makes it possible for unauthenticated quiz takers to exclude questions they answered incorrectly and inflate their stored quiz score.
References
- https://wpsec.com/vuln/WPSEC-2026-2893/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS