CVE-2023-0291: Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsmremovefilefdquestion AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-0291.
What is the title of the vulnerability?
The title of the vulnerability is 'The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8.'
What is the severity of CVE-2023-0291?
The severity of CVE-2023-0291 is critical with a severity value of 9.1.
Which software is affected by CVE-2023-0291?
The Quiz And Survey Master for WordPress versions up to, and including, 8.0.8 are affected by CVE-2023-0291.
How can an attacker exploit CVE-2023-0291?
Unauthenticated attackers can exploit CVE-2023-0291 to delete arbitrary files.