Authorization Bypass in Quiz And Survey Master Plugin for WordPress
CVE-2023-0291

9.1CRITICAL

Key Information:

Vendor
Wordpress
Status
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress
Vendor
CVE Published:
9 June 2023

Summary

The Quiz And Survey Master plugin for WordPress has a security flaw that allows unauthorized users to bypass legitimate access controls. This vulnerability arises from a missing capability check on the AJAX action linked to file management. As a result, unauthenticated attackers can delete arbitrary media files from the server, potentially leading to data loss or disruption of services. It is crucial for users of versions up to 8.0.8 to apply necessary updates to mitigate this risk.

Affected Version(s)

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress * <= 8.0.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/quiz-master-next/
https://packetstormsecurity.com/files/171011/wpqsm808-xsr...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Julien Ahrens
.