CVE-2025-9637CWE-862broken-access-control

CVE-2025-9637

Medium · published January 6, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-06T15:15Z
Affected products (1)
ProductVersionsFixed in
expresstech/quiz_and_survey_master< 10.3.210.3.2
References (4)
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L1987 · [email protected]https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L281 · [email protected]https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=cve · [email protected]
EPSS history
Timeline
  • 06 JAN 09:20Z
    Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
    cvelistv5