Insecure Direct Object Reference in Chained Quiz Plugin for WordPress

CVE-2025-10493

What is CVE-2025-10493?

The Chained Quiz plugin for WordPress has a vulnerability that allows unauthorized users to exploit the quiz submission and completion mechanisms. This is due to a lack of proper validation on a user-controlled parameter, specifically the chained_completion_id cookie. By manipulating this parameter, attackers can hijack quiz attempts, modify user submissions, and alter quiz outcomes without any authentication. While a partial fix was implemented in subsequent versions, maintaining updated software is essential to safeguard against potential exploits.

References