Cross-Site Request Forgery Vulnerability in Chained Quiz Plugin for WordPress

CVE-2022-4219

Summary

The Chained Quiz plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), affecting all versions up to and including 1.3.2.4. The vulnerability arises from the absence of nonce validation in the manage() function, which allows unauthenticated attackers to exploit this weakness. By tricking a site administrator into clicking a malicious link, the attacker could initiate unauthorized actions, such as deleting submitted quiz responses, posing a significant risk to the integrity of user-submitted data.

References