Arbitrary Shortcode Execution in Quiz Maker Plugins for WordPress
CVE-2024-10633

7.3HIGH

Key Information:

Vendor
Ays Pro Plugins
Status
Quiz Maker Developer
Quiz Maker Agency
Quiz Maker Business
Vendor
CVE Published:
26 January 2025

Summary

The Quiz Maker Business, Developer, and Agency plugins for WordPress allow arbitrary shortcode execution due to a lack of proper value validation. This vulnerability can be exploited by unauthenticated attackers, enabling them to execute arbitrary shortcodes, potentially leading to unauthorized access and manipulation of the website. All versions prior to specified updates are at risk, highlighting the importance of timely software updates to mitigate such security risks.

Affected Version(s)

Quiz Maker Agency * <= 31.8.0

Quiz Maker Business * <= 8.8.0

Quiz Maker Developer * <= 21.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://ays-pro.com/wordpress/quiz-maker
https://ays-pro.com/changelog-for-quiz-maker-pro

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

abrahack
.