CVE-2024-1079: Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval
The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the aysshowresults() function in all versions up to, and including, 6.5.2.4. This makes it possible for unauthenticated attackers to fetch arbitrary quiz results which can contain PII.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quiz Maker (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.5.2.4 - Configuration
Ensure the ays_show_results() function includes the missing capability/capability check so unauthenticated users cannot retrieve quiz results containing PII.
Quiz Maker (WordPress plugin) Authorization capability check on ays_show_results() = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1079?
CVE-2024-1079 is classified as a high severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2024-1079?
To fix CVE-2024-1079, update the Quiz Maker plugin to version 6.5.2.5 or later.
What type of vulnerability is CVE-2024-1079?
CVE-2024-1079 is a vulnerability that allows unauthorized access to quiz results due to missing capability checks.
Which versions of Quiz Maker are affected by CVE-2024-1079?
All versions of the Quiz Maker plugin up to and including 6.5.2.4 are affected by CVE-2024-1079.
What can an attacker do with CVE-2024-1079?
An attacker exploiting CVE-2024-1079 can fetch arbitrary quiz results, which may contain sensitive information.