CVE-2024-1079: Quiz Maker WordPress Information Disclosure

CVE-2024-1079 Overview

CVE-2024-1079 is a missing authorization vulnerability in the Quiz Maker plugin for WordPress developed by ays-pro. The flaw exists in the ays_show_results() function, which lacks a capability check in all versions up to and including 6.5.2.4. Unauthenticated attackers can invoke the function to retrieve arbitrary quiz results, which may contain personally identifiable information (PII) submitted by quiz respondents. The issue is tracked under CWE-862: Missing Authorization and was fixed in version 6.5.2.5.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary quiz result records containing PII from any affected WordPress site.

Affected Products

Ays-pro Quiz Maker plugin for WordPress, all versions through 6.5.2.4
WordPress installations using the vulnerable plugin
Sites collecting quiz responses that include user PII

Discovery Timeline

2024-02-07 - CVE-2024-1079 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1079

Vulnerability Analysis

The vulnerability resides in the ays_show_results() function within the Quiz Maker administrative code. The function returns quiz result data but does not verify the requester's capability or authentication state before responding. As a result, any client that can reach the WordPress AJAX endpoint can request stored quiz results without a valid session or role check.

Because quiz results frequently contain respondent-submitted information such as names, email addresses, scores, and free-text answers, exposure directly impacts data confidentiality. The vendor patch introduced the missing capability check in version 6.5.2.5, as reflected in the WordPress Plugin Changelog.

Root Cause

The root cause is a missing authorization check [CWE-862]. The ays_show_results() handler was registered as an AJAX endpoint accessible to unauthenticated users but did not call current_user_can() or a nonce validation before returning quiz data. This design flaw treats a sensitive data-retrieval endpoint as public.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker sends crafted HTTP requests to the WordPress AJAX endpoint invoking the ays_show_results action along with a target quiz or result identifier. The server returns the requested quiz result payload directly to the attacker.

No verified public exploit is currently indexed in Exploit-DB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Wordfence Vulnerability Report for additional detail.

Detection Methods for CVE-2024-1079

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to /wp-admin/admin-ajax.php containing the action=ays_show_results parameter.
Anomalous volumes of AJAX requests iterating through numeric quiz or result identifiers.
Requests to the Quiz Maker endpoint originating from IP addresses with no prior authenticated session.

Detection Strategies

Review web server access logs for admin-ajax.php calls referencing the ays_show_results action from anonymous clients.
Alert on sequential enumeration patterns against Quiz Maker result identifiers.
Correlate WordPress plugin version inventory with the vulnerable range up to 6.5.2.4.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform for baseline and anomaly detection.
Monitor outbound response sizes on AJAX endpoints to spot bulk data extraction.
Track plugin update status across managed WordPress deployments to identify unpatched instances.

How to Mitigate CVE-2024-1079

Immediate Actions Required

Upgrade the Quiz Maker plugin to version 6.5.2.5 or later on all WordPress installations.
Audit stored quiz results for evidence of prior unauthorized retrieval.
Notify affected respondents if analysis indicates PII was exposed.

Patch Information

The vendor released the fix in Quiz Maker version 6.5.2.5. The patch adds the missing capability check to ays_show_results() in admin/class-quiz-maker-admin.php. Refer to the WordPress Plugin Changelog for the exact code changes.

Workarounds

If immediate patching is not possible, deactivate the Quiz Maker plugin until the update is applied.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated requests to admin-ajax.php containing action=ays_show_results.
Restrict access to /wp-admin/admin-ajax.php by source IP where operationally feasible.

bash

# Example WAF rule (ModSecurity syntax) to block unauthenticated ays_show_results calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1002024,\
     msg:'Block unauthenticated Quiz Maker ays_show_results access (CVE-2024-1079)'"
    SecRule ARGS:action "@streq ays_show_results" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"