# Quiz and Survey Master (QSM) <= 11.3.0 - Unauthenticated Quiz Score Manipulation via qsm_hidden_questions Parameter

- **ID:** WPSEC-2026-2893
- **Plugin:** Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (`quiz-master-next`), https://wordpress.org/plugins/quiz-master-next/
- **Affected versions:** all versions before 11.3.1
- **Fixed in:** 11.3.1 (Update to 11.3.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quiz-master-next
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2893/

## Description

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to score manipulation via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.3.0, due to the plugin trusting the client-supplied list of hidden questions, which excludes those questions from both the earned points and the percentage denominator. This makes it possible for unauthenticated quiz takers to exclude questions they answered incorrectly and inflate their stored quiz score.

## References

- https://wpsec.com/vuln/WPSEC-2026-2893/
- https://plugins.svn.wordpress.org/quiz-master-next/tags/11.3.1/
- https://wordpress.org/plugins/quiz-master-next/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2893/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.