Description

Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T19:17:45.523Z",
  "pubdate": "2026-09-11T19:17:45.523Z",
  "executiveSummary": "The Quiz And Survey Master plugin for WordPress, specifically in versions 11.2.5 and below, contains an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability.\nThis vulnerability allows unauthorized remote attackers to access, view, or potentially manipulate sensitive data associated with quiz or survey entries without requiring administrative or user authentication.\nThe flaw stems from insufficient access control checks when processing object identifiers in application requests.\nAn attacker can exploit this by manipulating object references within URLs or parameters to bypass authorization mechanisms, leading to potential information disclosure of private user data or survey results.\nGiven that the vulnerability is exploitable without authentication, it poses a significant risk to the confidentiality and integrity of the data stored within the affected plugin.\nOrganizations relying on Quiz And Survey Master must consider this an critical security concern requiring immediate attention and remediation to prevent unauthorized data access.",
  "technicalDetails": "The vulnerability resides in the way the Quiz And Survey Master plugin handles requests directed at specific data objects (e.g., quiz results or survey entries).\nRoot Cause: The application fails to perform adequate server-side authorization checks to verify if the requesting user has the necessary privileges to access the requested object ID. Consequently, the plugin relies on predictable or easily discoverable identifiers, such as incrementing database keys or unique tokens, to retrieve sensitive information.\nExploitation Method: An unauthenticated attacker can identify valid object IDs through enumeration or information leakage from other parts of the application. By crafting a request—typically via GET or POST methods—that includes an manipulated object ID, the attacker can force the application to return data that should be restricted to authenticated administrators or the original owner of the survey data.\nAttack Flow: 1. The attacker performs reconnaissance to identify the endpoint responsible for fetching survey result details. 2. The attacker observes that the endpoint accepts an input parameter corresponding to a specific result identifier. 3. Because the application logic lacks a validation layer to check the user's session or role permissions, the attacker modifies the ID parameter to target arbitrary entries. 4. The server processes the request, fails to identify the lack of authorization, and returns the requested object data to the attacker.\nTechnical Impact: The vulnerability facilitates unauthorized Information Disclosure. An attacker could systematically enumerate entries to exfiltrate vast amounts of personal or survey-related data processed by the plugin. Furthermore, if the backend endpoint performs state-changing operations upon the object reference, this IDOR could theoretically be leveraged for unauthorized data modification or deletion.\nVulnerable Components: The vulnerability is present in the request handling components of the Quiz And Survey Master plugin that manage survey and quiz results. These components fail to validate the relationship between the authenticated user context and the requested object ID, effectively ignoring the security boundary intended by the plugin's access control model.\nNetwork Exposure: The vulnerability is remotely exploitable over HTTP/HTTPS, requiring no interaction from a privileged user to initiate the malicious request."
}