Junglewise Threat Intelligence

CVE-2026-13422: Harmonic Design HD Quiz CSRF in hdq_validate_nonce

CVE-2026-13422 · Severity: medium · CVSS 4.3 · Published 2026-06-27

Executive brief

The HD Quiz plugin for WordPress, which is used to create and manage interactive quizzes, is vulnerable to a security flaw that could allow an attacker to trick a site administrator into performing unintended actions. By convincing an administrator to click a malicious link, an attacker could delete or modify existing quizzes, create new ones, or change the plugin's settings. This could lead to unauthorized content changes or disruption of the website's quiz functionality.

Technical details

The HD Quiz plugin for WordPress (versions 2.2.0 to 2.2.1) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation within the hdq_validate_nonce function. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it (e.g., via social engineering or a malicious link). Successful exploitation allows the attacker to perform administrative actions such as deleting, modifying, or creating quizzes and questions, as well as altering plugin settings. The issue is addressed in version 2.2.2.

Affected products

  • Harmonic Design HD Quiz 2.2.0 - 2.2.1

Timeline

  • 2026-06-27: advisory: NVD publication date
  • 2026-06-26: disclosed: Wordfence disclosure date

References