Sensitive Information Exposure in Quiz Maker Plugin by WordPress

CVE-2025-12426

What is CVE-2025-12426?

The Quiz Maker plugin for WordPress has a vulnerability that allows attackers to access sensitive quiz information without authorization. This flaw is due to the improper validation of user permissions in the ays_quiz_check_answer AJAX action. The nonce verification implemented is inadequate, as it can be accessed publicly through the quiz_maker_ajax_public script data. Consequently, this allows unauthenticated users to exploit the vulnerability and retrieve quiz answers, compromising the confidentiality of the data.

References