Junglewise Threat Intelligence

CVE-2026-10623: PressPrimer Quiz IDOR in quiz rules REST API

CVE-2026-10623 · Severity: medium · CVSS 4.3 · Published 2026-06-18

Executive brief

The PressPrimer Quiz plugin for WordPress, which is used to create and manage educational quizzes and exams, contains a security flaw that allows users with basic teacher-level access to interfere with other users' content. An attacker can exploit this to modify or delete quiz rules belonging to other instructors, potentially disrupting exams or altering the grading structure of courses they do not own. This could lead to unauthorized changes in educational assessments and damage the integrity of the learning management system.

Technical details

The PressPrimer Quiz plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 2.3.0. This vulnerability exists within the REST API controller due to missing validation on the 'rule_id' parameter, which is a user-controlled key. Authenticated attackers with custom-level access (such as teachers) can manipulate this parameter to modify or delete quiz rules that belong to other users. The root cause is a lack of ownership verification in the affected REST endpoints. The issue was addressed in version 2.3.1 by implementing a centralized ownership check (get_owned_quiz_or_error) that ensures the requester has the necessary permissions or ownership over the quiz object being modified.

Affected products

  • PressPrimer PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin up to, and including, 2.3.0

Timeline

  • 2026-06-08: patched: Fix committed to GitHub repository
  • 2026-06-18: disclosed: CVE published and advisory released

References