CVE-2026-14825: Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/quiz-and-survey-masterto a version that resolves this vulnerability.Fixed in 11.2.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with contributor-level access or higher can exploit it. The issue affects their ability to modify front-end text settings for quizzes created by other users.
What access does an attacker need?
The attacker needs a WordPress account with at least the Contributor role. No information is provided indicating that unauthenticated users can exploit the issue.
Which versions are affected?
Quiz and Survey Master versions before 11.2.4 are affected. Updating to version 11.2.4 or later addresses the described issue.
How can I determine whether my site may be vulnerable?
Check the installed Quiz and Survey Master version and review which users have Contributor or higher roles. Sites running a version before 11.2.4 with such accounts may be exposed.