Is CVE-2026-9230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9230 being exploited in the wild.

How severe is CVE-2026-9230?

Medium severity, with a CVSS score of 4.3, published 3 July 2026.

Which products and versions are affected?

ExpressTech Quiz and Survey Master <= 11.1.4.

Is there a fix for CVE-2026-9230?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9230 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9230?

Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9230: ExpressTech Quiz and Survey Master authorization bypass

Q: Is there a fix for CVE-2026-9230?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-9230 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9230?

Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9230 · Severity: medium · CVSS 4.3 · Published 2026-07-03

The Quiz and Survey Master plugin for WordPress, used for creating interactive quizzes and surveys, contains a security flaw that allows unauthorized users to modify content. An attacker with a basic contributor account can change quizzes they do not own, alter results pages, and redirect notification emails to their own addresses. This could lead to the disruption of survey operations and the unauthorized interception of participant data.

Technologies: ExpressTech Quiz and Survey Master. Vendors: ExpressTech.

Quick answers

Is CVE-2026-9230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9230 being exploited in the wild.
How severe is CVE-2026-9230?: Medium severity, with a CVSS score of 4.3, published 3 July 2026.
Which products and versions are affected?: ExpressTech Quiz and Survey Master <= 11.1.4.
Is there a fix for CVE-2026-9230?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9230 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9230?: Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in all versions up to and including 11.1.4. The vulnerability exists because the plugin fails to verify quiz ownership when processing requests to certain REST API endpoints. An authenticated attacker with contributor-level permissions can exploit this by first calling the /quiz/structure endpoint with a victim's quiz ID to obtain a valid nonce. By presenting this nonce to the /quizzes/{id}/emails save endpoint, the attacker can bypass ownership checks to modify quiz structures, overwrite results pages, or change notification email recipients.

Affected products

ExpressTech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.4

Timeline

2026-07-03: disclosed: CVE published to the NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.