CVE-2026-25324: WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates it can be exploited remotely over the network without authentication or user interaction. An attacker would need to reach an affected Quiz And Survey Master installation.
What security impact is documented?
The documented impact is unauthorized modification of data or resources, reflected by an integrity impact of Low. No confidentiality or availability impact is listed.
Which versions should be considered affected?
Quiz And Survey Master versions through 10.3.4 are identified as affected. The provided data does not identify a fixed version.