Unauthorized Modification of Data Leads to Privilege Escalation in AI Quiz Plugin

CVE-2024-11323

Summary

The AI Quiz | Quiz Maker plugin for WordPress features a vulnerability that allows authenticated users with Subscriber-level access and higher to modify data without authorization, due to a missing capability check on the ai_quiz_update_style() function. This vulnerability permits potential attackers to change critical settings, such as updating the default role for new registrations to administrator and enabling user registration. By exploiting this issue, malicious actors can gain administrative access to affected WordPress sites, compromising the security and integrity of the site.

References