Executive brief
The Quiz and Survey Master plugin for WordPress, which is used to create quizzes and surveys, contains a security flaw in its login functionality. This flaw allows unauthorized individuals to identify valid usernames and attempt to guess passwords without being blocked by standard security tools. If successful, an attacker could gain unauthorized access to user accounts, potentially compromising personal information or site integrity.
Technical details
The vulnerability exists in the `qsm_ajax_login` action within the Quiz and Survey Master plugin. The application returns distinct error messages for non-existent usernames versus incorrect passwords, enabling unauthenticated user enumeration. Furthermore, the plugin does not trigger standard WordPress login hooks (like `wp_login_failed`) or implement internal rate limiting, allowing attackers to perform high-speed brute-force attacks that bypass common security plugins. A successful password match returns a JSON success response without creating a session, acting as a 'password oracle.' The issue is resolved in version 11.1.3.
Affected products
- ExpressTech Quiz and Survey Master (QSM) < 11.1.3
Timeline
- 2026-07-06: disclosed
- 2026-07-06: advisory
- 2026-07-27: other: NVD Published Date