# CVE-2026-62140: ExpressTech Quiz And Survey Master IDOR vulnerability

Source: https://junglewise.ai/threats/cve-2026-62140-expresstech-quiz-and-survey-master-idor-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-62140 · Severity: medium · CVSS 5.3 · Published 2026-09-11

Quiz And Survey Master is a popular WordPress plugin for creating and managing surveys and quizzes on websites. An unauthenticated attacker can exploit an insecure direct object reference vulnerability to access and view other users' survey and quiz data by manipulating identifiers in requests, potentially exposing sensitive user information without authentication.

Technologies: [ExpressTech Quiz and Survey Master](https://junglewise.ai/threats/technologies/quiz-and-survey-master). Vendors: [ExpressTech](https://junglewise.ai/threats/vendors/expresstech).

## Quick answers

**Is CVE-2026-62140 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62140 being exploited in the wild.

**How severe is CVE-2026-62140?** Medium severity, with a CVSS score of 5.3, published 11 September 2026.

**Which products and versions are affected?** ExpressTech Quiz and Survey Master <= 11.2.5.

**Is there a fix for CVE-2026-62140?** A patch was published on 2026-09-10: Fix available in version 11.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62140 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62140?** Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure direct object reference (IDOR) vulnerability exists in Quiz And Survey Master plugin versions 11.2.5 and earlier. The vulnerability allows unauthenticated attackers to access other users' quiz and survey data by directly manipulating object identifiers in URLs or API requests. No authentication is required to exploit this flaw, and the attack can be conducted remotely over the network. Successful exploitation exposes confidential survey responses and quiz results belonging to other users. The vulnerability was patched in version 11.2.6.

## Affected products

- ExpressTech Quiz And Survey Master <= 11.2.5

## Timeline

- 2026-07-21: disclosed: Vulnerability reported by Adam Kahlon (Adkali)
- 2026-09-10: advisory: Early warning issued to Patchstack customers and published
- 2026-09-10: patched: Fix available in version 11.2.6

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve)

## Related threats

- [ExpressTech Quiz And Survey Master broken access control](https://junglewise.ai/threats/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and)
- [ExpressTech Quiz And Survey Master XSS in content injection](https://junglewise.ai/threats/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web)
- [ExpressTech Quiz And Survey Master object injection](https://junglewise.ai/threats/cve-2026-111408-deserialization-of-untrusted-data-vulnerability-in-expresstech)
- [ExpressTech Quiz And Survey Master DOM-based XSS](https://junglewise.ai/threats/cve-2026-107862-improper-neutralization-of-input-during-web-page-generation)
- [ExpressTech Quiz And Survey Master object injection in deserialization](https://junglewise.ai/threats/cve-2026-104392-deserialization-of-untrusted-data-vulnerability-in-expresstech)