CVE-2026-14826: Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quiz And Survey Master (WordPress plugin)to a version that resolves this vulnerability.Fixed in 11.2.4 - Compensating control
Restrict access to QSM-related REST routes (e.g., via WordPress hardening, authentication/authorization controls, or a web application firewall/ACL) until the plugin is upgraded to 11.2.4.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with contributor-level access or higher can exploit it. The user does not need to own the target quiz.
What information can be exposed?
Affected REST routes can disclose another user's quiz email-notification and results-page configuration. This includes notification recipient email addresses.
Are sites affected by default?
The issue affects QSM versions before 11.2.4 when users with contributor-level or higher access exist. Exploitation requires an authenticated account with that role level.
What can be done until the plugin is updated?
Limit contributor-level and higher accounts to trusted users, and remove or reduce unnecessary accounts with those permissions. Review access to quiz configuration data because affected users may be able to view configuration for quizzes they did not create.