# CVE-2026-125787: ExpressTech Quiz And Survey Master broken access control

Source: https://junglewise.ai/threats/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-125787 · Severity: medium · CVSS 5.4 · Published 2026-11-12

ExpressTech Quiz And Survey Master is a WordPress plugin that lets users create and manage quizzes and surveys on their sites. A broken access control vulnerability allows contributors to access and perform actions on pages or data they should not be permitted to view or modify, potentially exposing private quiz responses or survey data.

Technologies: [ExpressTech Quiz and Survey Master](https://junglewise.ai/threats/technologies/quiz-and-survey-master). Vendors: [ExpressTech](https://junglewise.ai/threats/vendors/expresstech).

## Quick answers

**Is CVE-2026-125787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125787 being exploited in the wild.

**How severe is CVE-2026-125787?** Medium severity, with a CVSS score of 5.4, published 12 November 2026.

**Which products and versions are affected?** ExpressTech Quiz and Survey Master through 11.3.0.

**Is there a fix for CVE-2026-125787?** Yes: fixed in 11.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125787 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125787?** Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.3.1

## Technical details

The vulnerability is a broken access control issue in the quiz-master-next WordPress plugin affecting versions through 11.3.0. An attacker with contributor-level privileges can exploit incorrectly configured access controls to access restricted resources or perform unauthorized actions. The vulnerability is fixed in version 11.3.1.

## Affected products

- ExpressTech Quiz And Survey Master through 11.3.0

## Timeline

- 2026-10-20: disclosed
- 2026-11-12: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [ExpressTech Quiz And Survey Master XSS in content injection](https://junglewise.ai/threats/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web)
- [ExpressTech Quiz And Survey Master object injection](https://junglewise.ai/threats/cve-2026-111408-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [ExpressTech Quiz And Survey Master DOM-based XSS](https://junglewise.ai/threats/cve-2026-107862-improper-neutralization-of-input-during-web-page-generation)
- [ExpressTech Quiz And Survey Master object injection in deserialization](https://junglewise.ai/threats/cve-2026-104392-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [Quiz And Survey Master cross-site scripting](https://junglewise.ai/threats/cve-2026-97289-unauthenticated-cross-site-scripting-xss-in-quiz-and-survey)