Insecure Direct Object Reference in Chained Quiz Plugin for WordPress

CVE-2025-10493

What is CVE-2025-10493?

The Chained Quiz plugin for WordPress has a vulnerability that allows unauthorized users to exploit the quiz submission and completion mechanisms. This is due to a lack of proper validation on a user-controlled parameter, specifically the chained_completion_id cookie. By manipulating this parameter, attackers can hijack quiz attempts, modify user submissions, and alter quiz outcomes without any authentication. While a partial fix was implemented in subsequent versions, maintaining updated software is essential to safeguard against potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References