Description

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-28T08:16:42.150Z",
  "pubdate": "2026-08-28T08:16:42.150Z",
  "executiveSummary": "The Quiz and Survey Master (QSM) WordPress plugin contains a critical broken access control vulnerability originating from improper authorization checks within its REST API implementation.\nThe vulnerability allows authenticated users with low-level privileges, such as Contributors, to bypass intended security restrictions and gain unauthorized access to sensitive quiz configuration data.\nAn attacker can exploit this flaw to retrieve proprietary quiz questions, associated hints, and, most critically, the correct answer keys for quizzes created by other users.\nThe flaw affects the QSM plugin versions prior to 11.2.4.\nThis represents a significant information disclosure risk, potentially compromising the integrity of academic assessments, certifications, or internal surveys managed through the WordPress site.\nExploitation is trivial for an attacker possessing standard authenticated access, requiring no elevated privileges beyond the 'Contributor' role, and does not require complex social engineering or interaction with administrative users.",
  "technicalDetails": "The root cause of this vulnerability is an insecure REST API route implementation within the Quiz and Survey Master (QSM) plugin. Specifically, the function responsible for fetching and returning question bank entries fails to perform adequate authorization verification during the request handling process.\nWhen a user makes a request to the vulnerable REST API endpoint designed to retrieve question bank data, the plugin fails to validate whether the authenticated requester has the necessary permissions to access the requested quiz objects. It assumes that the presence of an authenticated session is sufficient for access, failing to verify the ownership or explicit access control lists (ACLs) associated with the specific quiz data being queried.\nAffected versions are strictly limited to those preceding 11.2.4. The component responsible is the REST API request handler for question bank retrieval. The vulnerability is exploitable via a standard authenticated HTTP GET request targeted at the affected REST API endpoint.\nAttack flow: 1. An attacker authenticates to the WordPress site with an account possessing at least the 'Contributor' capability. 2. The attacker identifies the REST API endpoint used by QSM to fetch questions. 3. The attacker crafts a request to this endpoint, potentially manipulating query parameters to iterate through IDs of quizzes created by other users. 4. Because the server-side code does not perform a permission check against the specific quiz ID requested, the REST API returns a JSON response containing the full dataset, including sensitive information such as question text, metadata, hints, and the defined correct answer keys. 5. The attacker parses this response to extract the sensitive data.\nThis vulnerability is inherently a broken object-level authorization (BOLA) flaw. The post-exploitation impact allows for full exposure of quiz contents. This can lead to the subversion of examinations, the compromise of confidential survey results, and the unauthorized extraction of intellectual property associated with quiz question banks. The exposure is limited to authenticated users; however, given the broad scope of the 'Contributor' role in many WordPress environments, this is a significant security deficiency."
}