Unauthorized Data Modification in Quiz Maker Plugins for WordPress

CVE-2024-10574

Summary

The Quiz Maker Business, Developer, and Agency plugins for WordPress exhibit a security flaw that allows attackers to modify sensitive Google Sheets integration settings. This issue arises from a lack of capability checks within the 'ays_save_google_credentials' function and poor handling of the 'client_id' parameter, enabling unauthenticated users to inject malicious web scripts. Attackers can exploit this vulnerability to manipulate data without proper authorization, posing significant risks to data integrity and user security.

References