Description

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T06:17:33.890Z",
  "pubdate": "2026-08-19T06:17:33.890Z",
  "executiveSummary": "An access control vulnerability has been identified in the Quiz and Survey Master (QSM) WordPress plugin affecting versions prior to 11.2.4. The vulnerability stems from the application failing to perform adequate per-object ownership checks on specific REST API endpoints. These exposed routes are responsible for returning the email-notification and results-page configurations associated with individual quizzes.\nThe security flaw carries significant risk implications as it allows unauthorized information disclosure across user boundaries. An attacker possessing contributor-level access or higher can leverage this vulnerability to query and read the internal configurations of quizzes created by other users on the same platform.\nThe primary impact of this exploitation is the unauthorized exposure of sensitive data. Specifically, the retrieved configurations include notification recipient email addresses, which could facilitate targeted phishing campaigns, reconnaissance, or further compromise against administrators and higher-privileged users.\nExploitation of this vulnerability requires authenticated access at the contributor role or above, meaning an attacker must first obtain valid low-privileged credentials within the WordPress installation. No complex payloads or advanced exploitation techniques are required beyond interacting with the vulnerable REST routes directly.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the REST API routing logic within the Quiz and Survey Master (QSM) WordPress plugin. Specifically, the backend controllers fail to enforce robust authorization checks that validate whether the requesting user owns or has legitimate administrative rights over the specific quiz object being queried.\nThe vulnerable components are the REST API endpoints designed to retrieve quiz configurations, specifically those governing email-notification settings and results-page parameters. Affected software versions include all instances of the Quiz and Survey Master (QSM) WordPress plugin prior to version 11.2.4.\nFrom an authentication and privilege perspective, the attack surface is exposed to network-based HTTP requests originating from authenticated users holding a role of contributor or higher. Although contributors normally possess restricted capabilities within WordPress regarding content publication and publishing settings, the flawed REST routes do not adequately restrict object-level access.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress site with a contributor-level account. Second, the attacker formulates an HTTP GET request targeting the vulnerable REST routes associated with the Quiz and Survey Master (QSM) plugin. Because the backend code lacks a per-object ownership check, the application processes the request without verifying if the authenticated user is the author or authorized manager of the target quiz ID. Third, the server responds by returning the complete quiz configuration payload. Finally, the attacker parses the returned JSON or data structure to extract sensitive configuration details, including internal email addresses utilized as notification recipients.\nThe post-exploitation impact centers on unauthorized information disclosure. By harvesting notification recipient addresses and internal configuration parameters, the malicious actor obtains intelligence that can be weaponized for subsequent attack vectors, such as social engineering attacks targeting administrative personnel or identifying weaknesses in the quiz workflow."
}