CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
Explanation of Vulnerability in Simple Terms
Quiz and Survey Master versions up to 8.0.4 contain an input validation flaw that allows unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 8.0.4 to remediate the issue.
What an attacker can do
Modify quiz, survey, or other plugin data without authentication.
Potential impact on your site
Quiz and survey responses or settings could be altered or corrupted by unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
