Critical · published January 1, 2021
CVSS calls it critical at 9.9. It sits in the 99.5th percentile for exploit probability.
🚨 An unauthenticated file deletion flaw in the Quiz and Survey Master plugin could turn your WordPress site into a ghost town! 🔥 Imagine a careless janitor tossing out important documents from the office because the storage room had an open door. This vulnerability allows anyone to sweep away critical files like wp-config.php, leaving your site vulnerable and potentially offline. An attacker could delete crucial files, including your wp-config.php, effectively taking your site offline. This means they could reinstall WordPress under their control, leading to unauthorized access and data loss. The consequences could be absolutely devastating, putting your site's integrity at major risk!
Imagine a careless janitor tossing out important documents from the office because the storage room had an open door. This vulnerability allows anyone to sweep away critical files like wp-config.php, leaving your site vulnerable and potentially offline. This vulnerability arises from the qsm_remove_file_fd_question function in the Quiz and Survey Master plugin, which mistakenly allows unauthenticated users to delete arbitrary files, instead of just their own quiz-answer files.
An attacker could delete crucial files, including your wp-config.php, effectively taking your site offline. This means they could reinstall WordPress under their control, leading to unauthorized access and data loss. The consequences could be absolutely devastating, putting your site's integrity at major risk! Upgrade the Quiz and Survey Master plugin to version 7.0.1 immediately to patch this vulnerability. Additionally, review your file permissions and ensure that only authorized users can delete files. A security audit may also be beneficial to assess any other potential risks. You've got this! With these steps, you'll fortify your site and keep those pesky attackers at bay. 🛡️