CVE-2023-36522 MEDIUM

CVE-2023-36522: WordPress Quiz Expert – Easy Quiz Maker, Exam and Test Manager Plugin <= 1.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Wepupil

Product Quiz Expert

Weakness CWE-352 · CSRF

Published July 11, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in WePupil Quiz Expert plugin <= 1.5.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Quiz Expert versions up to 1.5.0 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site visitors. An attacker can craft a malicious link or page that, when visited by a logged-in user, triggers unwanted changes to quiz settings or data. The vulnerability requires user interaction and does not expose sensitive information directly.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site by tricking a logged-in user into visiting a malicious page.

Potential impact on your site

04Site Impact

Quiz settings or data could be modified without your knowledge if users are tricked into visiting malicious pages.

Conditions required to exploit

05Prerequisites

A site visitor must be logged in and click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

July 11, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-36522 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities