CVE-2025-12426: Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the aysquizcheckanswer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quizmakerajaxpublic localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12426?
The severity of CVE-2025-12426 is considered to be high due to the potential exposure of sensitive information.
How do I fix CVE-2025-12426?
To fix CVE-2025-12426, update the Quiz Maker plugin to version 6.7.0.81 or later.
What specific vulnerability does CVE-2025-12426 present?
CVE-2025-12426 presents a vulnerability of Sensitive Information Exposure through the unauthorized disclosure of quiz answers.
Which versions of Quiz Maker are affected by CVE-2025-12426?
All versions of the Quiz Maker plugin up to and including 6.7.0.80 are affected by CVE-2025-12426.
What types of data are compromised by CVE-2025-12426?
CVE-2025-12426 compromises sensitive quiz answer data that can be exposed without proper authorization.