Junglewise Threat Intelligence

CVE-2026-14820: Quiz and Survey Master user enumeration and brute-force bypass

CVE-2026-14820 · Severity: info · CVSS 5.3 · Published 2026-07-27

Technologies: ExpressTech Quiz and Survey Master. Vendors: ExpressTech.

Executive brief

The Quiz and Survey Master plugin for WordPress, which is used to create quizzes and surveys, contains a security flaw in its login functionality. This flaw allows unauthorized individuals to identify valid usernames and attempt to guess passwords without being blocked by standard security tools. If successful, an attacker could gain unauthorized access to user accounts, potentially compromising personal information or site integrity.

Technical details

The vulnerability exists in the `qsm_ajax_login` action within the Quiz and Survey Master plugin. The application returns distinct error messages for non-existent usernames versus incorrect passwords, enabling unauthenticated user enumeration. Furthermore, the plugin does not trigger standard WordPress login hooks (like `wp_login_failed`) or implement internal rate limiting, allowing attackers to perform high-speed brute-force attacks that bypass common security plugins. A successful password match returns a JSON success response without creating a session, acting as a 'password oracle.' The issue is resolved in version 11.1.3.

Affected products

  • ExpressTech Quiz and Survey Master (QSM) < 11.1.3

Timeline

  • 2026-07-06: disclosed
  • 2026-07-06: advisory
  • 2026-07-27: other: NVD Published Date

References

Related threats