CVE-2026-79615CWE-639

CVE-2026-79615

Low · published August 28, 2026

CVSS v3.1

2.7

EPSS

Percentile

21.5

In the wild

Unconfirmed

What it is

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.

The record

Technical detail

CVSS v3.1: 2.7 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00299 · 21.5th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-28T12:16Z

References (1)

https://wpscan.com/vulnerability/f4c77fda-edc2-44c5-95d9-358636896b5f/ · [email protected]

EPSS history

Timeline

28 AUG 06:00Z
Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR
cvelistv5