CVE-2024-10574: Quiz Maker Auth Bypass Vulnerability

CVE-2024-10574 Overview

CVE-2024-10574 affects the Quiz Maker Business, Developer, and Agency plugins for WordPress. The vulnerability stems from a missing capability check on the ays_save_google_credentials function. Unauthenticated attackers can modify Google Sheets integration credentials stored in the plugin's settings. The client_id parameter is not sanitized or escaped on output, enabling stored Cross-Site Scripting (XSS) when administrators view affected pages. The flaw is classified under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can overwrite Google Sheets integration credentials and inject arbitrary JavaScript that executes in administrator browsers, enabling account takeover and data exfiltration paths.

Affected Products

Quiz Maker Business plugin for WordPress, all versions up to and including 8.8.0
Quiz Maker Developer plugin for WordPress, all versions up to and including 21.8.0
Quiz Maker Agency plugin for WordPress, all versions up to and including 31.8.0

Discovery Timeline

2025-01-26 - CVE-2024-10574 published to the National Vulnerability Database (NVD)
2026-04-15 - CVE-2024-10574 last updated in NVD

Technical Details for CVE-2024-10574

Vulnerability Analysis

The Quiz Maker plugin family exposes an Asynchronous JavaScript and XML (AJAX) action handled by the ays_save_google_credentials function. This handler updates the plugin's Google Sheets integration settings, including OAuth client_id and related credentials. The function does not verify the caller's WordPress capability, so requests from unauthenticated users are accepted and persisted. An attacker can replace legitimate integration credentials with attacker-controlled values, redirecting quiz response data or breaking the integration entirely.

The same handler stores the submitted client_id value without sanitization. When an administrator subsequently loads the plugin settings page, the unescaped value is rendered into HTML, executing any attacker-supplied JavaScript in the administrator session. This produces a stored Cross-Site Scripting (XSS) primitive chained directly to the authorization flaw.

Root Cause

The root cause is the absence of a current_user_can() capability check and a wp_verify_nonce() validation inside ays_save_google_credentials. Combined with output encoding gaps on the client_id field, the handler violates both WordPress authorization conventions and the principle of treating all user input as untrusted on output.

Attack Vector

Exploitation requires only network access to the WordPress site's admin-ajax.php endpoint. The attacker sends a crafted POST request invoking the vulnerable action with malicious client_id content. No authentication, user interaction, or prior access is needed. Because the scope changes (S:C) and the payload executes in an administrator context once the settings page is viewed, the attacker can pivot to full site compromise through privileged actions performed by the victim browser.

No verified public proof-of-concept code is currently linked to this CVE. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-10574

Indicators of Compromise

Unexpected modifications to Quiz Maker Google Sheets integration settings, particularly to the client_id field containing HTML or <script> content.
POST requests to /wp-admin/admin-ajax.php with action=ays_save_google_credentials originating from unauthenticated sessions or unusual IP addresses.
New or altered administrator accounts, plugins, or themes created shortly after suspicious AJAX traffic to the Quiz Maker endpoint.

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php carrying the ays_save_google_credentials action without an authenticated wordpress_logged_in cookie.
Audit the WordPress options table for Quiz Maker settings rows containing script tags, event handlers (onerror=, onload=), or unexpected external URLs.
Correlate plugin setting changes with administrator session activity to identify modifications that lack a corresponding authenticated user.

Monitoring Recommendations

Enable WordPress audit logging for plugin option changes and review entries for Quiz Maker keys daily.
Alert on outbound connections from administrator browsers to domains not associated with Google OAuth endpoints after visits to Quiz Maker settings pages.
Monitor Web Application Firewall (WAF) telemetry for unauthenticated POSTs targeting ays_save_google_credentials.

How to Mitigate CVE-2024-10574

Immediate Actions Required

Update Quiz Maker Business beyond 8.8.0, Quiz Maker Developer beyond 21.8.0, and Quiz Maker Agency beyond 31.8.0 to a patched release listed in the Ays-Pro Change Log.
Review and reset Google Sheets integration credentials configured in the plugin, rotating any OAuth client_id and client_secret values that may have been overwritten.
Scan all Quiz Maker settings fields for stored JavaScript payloads and remove malicious content before administrators next access the settings page.

Patch Information

The vendor has published fixes in the Ays-Pro Quiz Maker Pro release notes. Confirm the installed plugin version against the vendor's Quiz Maker Overview page and apply the latest release that includes the capability check and output escaping for ays_save_google_credentials. Refer to the Wordfence Vulnerability Report for fixed version confirmation.

Workarounds

Restrict access to wp-admin/admin-ajax.php from untrusted networks using WAF rules or IP allowlisting until the patch is applied.
Deactivate the Quiz Maker Business, Developer, or Agency plugin on production sites that cannot be updated immediately.
Apply a WAF signature that blocks unauthenticated requests containing action=ays_save_google_credentials in the POST body.

bash

# Example WAF rule (ModSecurity) to block unauthenticated calls to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1024010574,msg:'Block CVE-2024-10574 Quiz Maker unauth action'"
  SecRule ARGS:action "@streq ays_save_google_credentials" \
    "chain"
    SecRule &REQUEST_COOKIES:/^wordpress_logged_in_/ "@eq 0"