CVE-2023-23985 LOW

CVE-2023-23985: WordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing

Vendor Quiz Maker Team

Product Quiz Maker

Weakness CWE-862 · Missing authorization

Published April 24, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.

Explanation of Vulnerability in Simple Terms

02Summary

Quiz Maker versions up to 6.3.9.4 lack proper authorization checks, allowing an attacker to modify quiz data without authentication. The vulnerability requires specific network conditions to exploit but does not affect data confidentiality or system availability. Site administrators should update to a version newer than 6.3.9.4.

What an attacker can do

03Attacker Capabilities

Modify quiz content or settings without logging in.

Potential impact on your site

04Site Impact

Quiz data could be altered by unauthorized users, affecting quiz integrity and user experience.

Conditions required to exploit

05Prerequisites

Network access to the site; specific conditions must be met to trigger the vulnerability.

Key dates

06Disclosure timeline

April 24, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-23985 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities