Executive brief
Quiz and Survey Master is a WordPress plugin used to create quizzes and surveys on websites. A flaw in its REST API allows low-privilege user accounts (Contributors) to view quiz questions, hints, and answer keys from quizzes created by other users, potentially exposing sensitive quiz content and correct answers across the site.
Technical details
The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API endpoint `/wp-json/quiz-survey-master/v1/bank_questions/` that fails to properly authorize access to question bank entries. The vulnerable code returns quiz questions, answers, hints, and answer keys without verifying that the requesting user owns the target quiz. A Contributor-level user can exploit this by obtaining a REST API nonce and calling the endpoint with any quiz ID to read all associated question data. The plugin's standard post editor correctly enforces ownership checks, confirming that the REST route bypasses intended access controls. Fixed in version 11.2.4.
Affected products
- WordPress.org Quiz and Survey Master before 11.2.4
Timeline
- 2026-08-26: disclosed
- 2026-08-28: advisory